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MiilTV af Ihc nrliclcs pLihlislioU in COMPUTiST (lutiiil IhL- i-L-nntval of napy protection schonios 
IVniii ci^tmiKirml disk.s or contiiiii iiiforniaiion on copy protection a.nd tiackup mciiiod.s in jzcncral, 
Wc iilso print bit.wjpy piirtititetor^. tip^ roru<.lvi;nlurt;^uiiia'j, udvaibCfU platfiiii; icuhmquos (APT's) 
ihr:jrt::idi' aiatiw I'anatii.'^ and :iny odier inforniation which m^y bo oi'iiSL' to the KcrioUK Apple tiscr. 
C'OMl'l.Ti.S'l also contains it special CORE .seclioii which locust on inforninlioii nu( dirccdy 
ri'liikiil In cop) prolfflion. Topics iviay include, hiil arc not limited to; tutorials, hardwarc/soltwarc 
product reviews unti Lipp][catu>[i imtJ uLility pi'i.jyiaiiis. 



What Is A Snftkey Anyway? Si>rtkc> is j tunn 
^UiiL'ti VM' l'iiiiilil] [(J iJi:sinlK.' a|aiH:L'iJliiL' lllJl li'inu^es. 
tjr ill lija.-,i citcLLiii vents, ij-n> Cop\ pi<^tcclit>n nn ii 
partU'Liltir (hsk tJiicc a s^snt^^-'V priK'^duu- has huci! 
[lorfoniTini. ItiL' rcsLiltiny disk can uMiall^ be c<ipicd b) 
t!iL> Liso nf Apjik^'s-COPYA firciiiraiii (Oil ihi' IIO.S * ! 
Svsii.-iii Maslcr i'Jish) 

CtiEiuiuiuils Ajiil Controls: In any ank-k' appLSirinj! 
In CfJMPUTlSI iiiiiini.imis w high a ivaiL'r is ivqiiiicil 
K> poM^H'nl liro >(.'l ap^^1■l iVfim nLirnia! U'\1 h\ hiMil^" 
mdcnitxl iintt bk>k1 An csainpk- is: 

I'Rffft 

i-dlliiv, iliis wall dif Kill t-KN ko. Ihc KhTtJKN kc; 
must t^ pivsscd [It Itic end tifi:vi,>rj saiti L'oniiii;md uiik'ss 
liillflwisi: s|Hvilk:d. 

C'ltntrril cfiaraL'iL-'rs ai:i: tridivatoil 1h htdnt? k-vxcit An 
i:\aiiipk' is: 

To I'liinpU'tc tliiit i-'iiimiTand. *nti itsli;.! I'ifst iVit> IK' 
iiUinhci' <> anJ tticn pkic^: ^^iik: t"mt;cr ^>ii the- CTRL kc) 
u3id oiil: fiiii^O]' an itK' r* kov 

RequlremtntN: Mn>t (if the pnigtanis anJ siiftkcys 
%\[iic]i LipfjLZjr in t'OMI'l Ti^r ]'cqLLii'e oiv^ otlhc Apple 
|[ ^cifccs or ii)inpnlci>.and at lonst ^M^c tlisk di"ive with 
DOS -1.-1 Oecasionallv. sniiic priigrilitivanil pnKvdurL's 
iiuv^^ ^t?^-*L-Lal [eqiLijCLnents. Thi: picretjLUhitcs tor 
dL-pnueciinn icehniqucs or pro^triitiis wih aluays lie hsted 
at Mil' tx-'t'innint? i)t tlie LjrtieEc uiuJtT the ■'Ret|Liiivnients: 
headhii!, 

St>fti\'ai"t Rtconimcndatic^ns: Tlie IsNlluvvin^ pH}- 
i;Mnts (ar sinuliir iincsi .nv sli"ntiL;lj' reeoiiiiwndcd tor 
leadeis v^Uii wistt til irhiaiii tjie most htncJJl tViiivi oai 
nitlek's; 

1) .Vp[ili'si)ri Pi'ii^i':iiii hjillliM' sii^'l] asCikrlial Pit7^]iii]| 
Line lidlt.ii- iGPLIl) 

2) Swtor I'Nitiir sm-h iis Disklidit. /.W^ Irnm tiajj til 
Irii-ks .ir liieky I5iek Iroiii Tlic CIA. 

.^) Disk .Siiiircli t mill siicli ,is I'tie lilspeetiM. lite 

I laeei' Irimi ['he CI.A or The CORli Disk Se^irdicr. 

4> .'\ssi'iiihk'r siiefl IIS ihi^ S T Assign ihk^r or Meil[rl.''Kii: 

Mae 

?) Hit Cnpv l'n>^rnrFi stij;il n.s ^.'(^py || Plus- ! .rli-kSMliltl 

iir Tlu: t^ssemtnl Dala Dtiplieiitor 
6^ Text (''ditor eapni"ile at produeing nariiHil s;X|Lientml 

text litessia.li .is Applcwritei' II . Maiiie Windau- {| 

1)1" Scre'L'nvi t'iicr 1| 
Y9U i^iil also tlrtil COPYA. riD.ind MUI-SMN tVimi 
itic DOS .v.^ Svsicm Miisicr Disk useful. 
Supi;r lOB: Ttiis pnij:ram tias iiikist rctcnti} (ippcjircd 
iti COMPUriST \o. 22. -Several softke-v procedure will 
nijke- use i,tt j .Super 10 E ecnuioller. a smjll proeraiii 
tliut intiM he kcu'd inm ihe middle nf Super K)B. The 
controller elian^es Super lOB so that it can copy ililTereni 
tlisk.s, Tti ^et the laiL-sl vt^i'>itin iiVtbts progri^tn. ynu inay 
tirder COMPt. I LSI Nii. 22 asa tiack issue or order 

Pi-o-raiii l.it>r:ily Disk .Vo. 22. 

RKSEI' liiEo Tilt Munitnr: .Some soltkey pro- 
ectlures rct|tii!>,' tlint ttte a^ur t^e able to enter the .Apple'.v 
sssteiiimtNiittii tlurin^ Ihtcsekittion otii tupy prrtteeted 
program. Cheek tlie t'olliiw-iui; list lo see u'hat harJsV'iire 
uju \sjII tieed to ui^tain this atiitity. 

Appit I J Plus- .\pple .'/e- .\pplt eompatitjles: I) Plaee 
jii liitei^ei aA.SlC KUM eard in one uf (he Apple slots. 
2) L">o a iinn-iiitiskahle interrupt (XMI) eurd suelt Ufi 
Keplay in Wtkleiiul. 

Ajipk- II Plu.H - Apple edJupalihlLij: 1 1 Irlstall an FH ROM 
wttti a iiiodj|jed KhSEt veetoi on iht (.omptller's 



1 11 nl li e rbaii [-^l . ii s detiu ted indie M tnt i fl ed Rtl V] ' >' ' a n ie I e 

01 CO.Mln I [SI' .Vti. (I or ihe --Dual ROM's ' artkle 
in COMPl-'TlST Ni>. Pt. 

Apple Hv - Appiv 'i\': Install a lumiined Cn ROM an 
the eomputer's tiiotlicrbaanl. Chi) llarrell's emiipany 
(Cnllnij! Kd^M I- lit.: Uny 4- C U Ken fen SUituHi ItC. 
Retriiir, Ml 4!!241( sells a Itard-Lvaie device tlitit will 
."ive yiiti this ahihiy MLikint.' Ihis modifieatitin to an 
Apple ■'■'c vv-ill \'ajd \u v^'ananly hut ttie iiterea.ved jhility 
111 rL'iittJVi: I'nriy ]initeetloii may ]ttstll> tl. 

Reomniieiided Literature: the ."ipple ]] Reference 
Vlntiual and DOS .1 .1 m;iiiu:.d are ninsis I'm any seriiiiis 
Apple user, Other he! pin I books ineliKle: O^'tHuth Appk' 
DOS. Dtiti Worth and Pietcr Leehiier. Otmltly Sotiware. 
SI9.9S; .•h'.cmhlf Liminiii/ic hn Thr i/TJifi'sntl 
Pi'<{\^i\iriii!ii-r- Roy Meyers anil C W riiiley .^^klison 
Vf e s I e V . S 1 [j . y 5 . and H7jt(I '.^ I I'Jd- n- In 11 1 c Ap;>lc. 
William l-uhert. .Micro Ink.. S24.'JS 

[vt> i 11 n I n A pples* )f t Prog ran i.s : B A S 1 1" ' 1 1 1 1 ijf i ai 1 1 s 

are printed in C<)MRl"TIST in :i lornint thut is dcstitned 
to mtniiiii/.e errtirs JOr leaders who key tri these pitiLiianis. 
To understand Ihis Ibmiat. yna must fii'si understand the 

luimatteLl I.ISI I'eiituie of Apple-satf. 

Ati illustlation- If you slriKe lliese keys'; 

If) H(>MF.:RF.M('i.KAR NCRKEN 
a pioerum will he stored m the computer's ntemory. 
.Sti'anj^ely. tills proi^rtun will Jiaf have a LIST rhttt is 
esLiLlK js vuu IvfjLtt it. Instead- the LIST Will kiak like 
this: 

in HO.Vir. ; RKM CLKAK St RE KM 

F^rosii'arit.'^ dan't u^Uidly LIST the same as they weie 
keyed in iKiCviiise .^ppliisoll installs sfiaees iiitii a fitiiinam 
listinj: bet'iTre and alter every command \yiii'd or 
malheiiiatieal operator. These spaces usutilly don't post,' 
a problem excepi in line numbers wliich etiiituin RHM 

nr r>ATA I'animand wards. The s|>aee inseiteil iillei these 
command word.s can be miskydiiii:. For example. 11 yati 
w-:int n firai^niin In hnw' Ji lis! like Ihis: 

IB PAtA 67.45,54,52 
vi^u u oil Id Imve lo atiiii I he spiiee direetly after the D.AT.A 
L:iiiiiiiaii]d wtiril II you were to key in the spact;diiccll> 
after the DATA e<^niman(.l word, the LLSTol'tlie proarani 
".oukl loak like this. 

IH DATA 67,45,34,52 
This LIST isdil'lerem fniiii the 1. 1ST yon waumil The 
nnmber ol' spaces you key after DA'l'A and ELM 
command winds is very tmporiuni. 

All ol" this hrings us to Ihe COMPUTIS'I" l.ISTitti; 
I'orntiit. In a B.AStC LISTin^:- there are two types of 
sp,Eee^. spaces thjt ^lorrt matter whether they are keyetl 
nr not iind sptiees that nnisl he keyed SiBii'Os ihil niiKI 
be keyed In are printetl as delta characters (*i All other 
spiiee's in a COMPUTIST BASIC listinu are pin lheri> 
for easiei leLiJiiiu ,uld it dtiesii'l matter yv'hethijrydu lype 

iheiii nr not. 

I lleie IS one eAceptian. It you want ya;ir checksum^ 
(See ""Computinji Cheeksuins" .NCeiioni lo match np, you 
iim\! u/ii key iii any spaces altei a DA \A etiinmaud word 
unles.^ they are ntLirked by delta eharaeters 
Keying [ii Htxdtitnps; Maelime languaj^c progtiuiis 
arc printed in tX)MPUTIST a:, hoili s<Hiree code and 
hcAdunips Only one ol lliese foiinais need he keyed in 
10 tiet a machine iansjuaite piiittraiii. Hendumps ure the 

shartesl and easiest laiiniil la Ivpe in. 

To key in hc\dunips, ytiu must first enter the nioniior: 

CAI.i. Lst 

Now key ill the hesduinp esjetly as it appear^ in the 
nia<;;a/.ine i^norinti (he t'otir dijiil L'lieeksnni at dur end 
ot'.cach line la "■? " iind t'ourdifiils). U'yoii hear a beep. 



>tiu ^\ill kiat^v. that you Itave 1) pci.1 '^onicthmu 
iiieoneetly mid must I'ctspe that line. 
Wlieii linislied. ietnin In HASH' with a. 

Reiiuaiiljei In tiSAVI' (he pi oi'.iaiii widi llieeaiieel 
tdenanie. laidrc^^ .inj lerit^lh. p.UMiiieters as^jveii in 
Ihe anu'li' 

Keying In .Soiuxe Code the toiiice eode 
pottion ol'a machine kinguitiie prnaram is prm kled 
iinl\ lo beiiei esfilain ihe fJro^'.iiim'sopeiLitiuii. ll'you 
wish lo key ii in. you \ylll need an assetnhlcr, Th^;. 
S C Assembler i^, iisi\l tn f^eneraie all source is^de., 
printed in COMPUTIST. Without Ihis as^elllWet. 
you will have' m transltne pieces ot ilic ■voiirce I'lirle 
into xiinediiiit^ VMjf'- assenihlei' vnll iiiidci stand. .'V 
labk' ol .S C ■ysMaiibliif diissi Ki". rn'^i nir Ihe, [.jiirjuise 
was primed mCOMl'l'TlST Ntc 17 In translate 
stinree code, y^it yvHI pu^'d lo iindersianit llie 
directives ^^\' iotir ,l^■^emhlel ,ir.d son\.eri tlif. 
dircelives used in the siiuvee i'iilIo listinit to siniikir 
direciives usetl by your asseniblcr 
Coinputins; Clieckstims ("heek>.ums are lour 
diait he\adeciitiai mimberswhi: h \erii'v wheilteror 
not \oa keyed a proi^ram ex.ieily as n \mis. printed 
in rOMPlJlTST There are ueo types of eheeksunis' 
one eieaicd In lite CHECK-BIN prot^ranl (tor 

machine latieuaee proi;raiii>J arul the other erealed 
by the Cl'lhCKSOU pio^inm itoi BASIt." 
piiwaiiisl Bulk proi!rains appealed in CI'lVlPUTlS'l" 
Va. I .Litd rile I^est til Ha lek ore Ci^iiputing An 
update lo CHKCKSOFT appeared m COMTt'lTSi 
\o. IJt. tl Ihe cheeksutnsdhese pnieraiits create nu 
vtiur eompviler iiialeh theetieeksLiiiis aeeainpany msi 
llie [iiof'tam 111 tile maea/mc. Iheu you keyed in tlie 
program e\Vr reel ly. Ilnat, Ihc proeranl i^ iiieaneel 
Lit die litre wheie the fiist ehecLsuiir ditters 

!i To etnnpuie Ci IHCK.SOFJ' cheCik'sitflis 

I.(IA1> lileiiumi' 
BRINCIUXKSOIT 

riel tfie ehCeksuniv ^* ilh 

& 

And tiiri'cet the prottraiii ^liierc Ihc etiecksutiivtUd'cf. 
:;t To cjimpute CI11.-,CKBIN cheeMums,; 

CALL -151 

BLOAI1 tik-iiNiiu' 
liislnll CHF.rKBlN' III an nui nflliewui place 

i<Mt;\ I lll'.t kIll\.At()HHH 
Ciet tlie ehcekstims by (y pine the staitmu ;a3d|■e^s. 
;i period iind ciidin": address .d die lile lidkweeil h.-. 
abv]. 

ASA.s-svnvi 

And eorreel ihe lines at uliieh the eheeksum.vditter- 



Coping with 
COMPUTIST 

Welctnne (n COMHlTl^iT, a pnUlicatinn 
devoted to the serious user of .Apple jl and 
Apple ][ eompittibic computers. Our 
tnii^a^inc cuntain.s in form it I ion you arc not 
Ukelv tu find in iinv ol the nrher iniijnr 
jouniab dedicated to the Apple inarkeL 

Oui' odilorial policy is that we do NOT 
ctmdtmt soft wart piracy , hut wc do htlievc 
thai honest users are entitled lo backup 
cnmniercial disk^ tlie> havt purclia.std. In 

arlHition to the .si^curity oi' a haekiip rli.sk, 
the retniital of copy ptntiTtion j;ives the user 
(he option of iniulify iii;; applietitioii 
projjrams to meet his nr her need.s. 

.Seyv reader.s are advised to read this pa^e 
carefully lo avoid frtistration \v hen 
attempting to folloiv a soltkey or « hen 
entering live programs printed in this is'aie. 



editorial : 



a message 
to our readers 

Hello, readers. Let's atan hy reminding you to Till oul and send in the survey we 
primed in COMPUTIST No. 33. (Look again. It's on pages 31 and 32.) We really 
would like to know who our readers are and what they are interested in. The survey 
contains several important questions that ask your opinion on some changes we iiavg 
been consideimg making to COMPUTIS'i'. 

more hardware 

As wc pointed out in the last issue, the number of COMPU'UST readers is less than 
we would like. We are trying several methods for improving this situation. One idea 
we have is to expand into areas other than softkeys. In particular, we are thinking abouC 
including more hardware articles. 

Some of the projects we were considering include; 

• A two-computer bidirectional communications interface that uses the game port. 

• A sixteen-LED panel that shows you in what 4K bank the microprocessor is currently 
executing. 

• A ''front panel" that shows you the hexadecimal address of the current instruction 
being executed. This front panel will also be able to slow your computer and single 
step the 6502 instructions. 

• A card that would allow you to define (and redefine) the character .set of your //e 
(and possibly some || Pluses). This card allows extremely fast, easy-to-progam icon- 
based graphics. 

• The official softkey card. This card has ROM that replaces the motherboard ROM 
and therefore gives you a whole new (and more powerful) operating envirotncm. This 
card would be practically indespensible for breaking programs. 

The hardware projects are listed above in order of price with the least expensive 
appearing first. We would appreciate it if you would tell us if you are interested in 
constructing (or purchasing a prebuilt model of) one or more of these devices. 

more software 

Another area we would like to expand is software printed in COMPUTIST. Programs 
and articles we've printed have ranged from disk utilities to reviews to games and game 
cheats. Most of these are submitted by our readers (hint! hint!). Generally, we would 
like to see enough unique diings to keep COMPUTIST different from "other 
magazines." 

Depending on the answers we get out of the reader survey, there may be other 
additions/improvements to come. The main goal of all this is to make COMPUTIST 
more useful, educational, and entertaining to a wider audience. We're not .t;elling out 
to commercialism by shifting our focus. 

Wc don't plan to eliminate softkeys from the pages of COMPUTIST. We still feel 
thai copy-protection is un-American. We also believe that you would be better served 
by our publication if it provided a greater variety of features. 

Since you, our readers, are also our writers, we would like to see some articles on 
a wider range of topics from you. These could be things like hardware modifications, 
original utility programs, software tips and tricks (DOS, machine language, BASIC), 
tutorials, stunts you can do with your favorite peripherals and cards, and of course 
softkeys. 

If you have other conmients, suggestions, complaints, etc., don't be afraid to write 
us about them. We have an open mind. 
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FREE COMPUTIST 



YESl You Get 2 FREE ISSUES 

for every NEW subscriber that you sign up, 

We^U extend your current subscription by 2 issues for every new paid subscription 
you get to fill out the subscriber forms below. 

BUT... First Class subscribers MUST recruit First C(a.ss subscriptions tu receive the 2 extra issues. 

This rule (same mailing class) also applies to Foreign rates. 

Standard US subscribers can recruit any new subscriptions and extend their standard subscriptions. 

US ftinds drawn on US bank. Send check/money order to: COMPUTIST PO Box 1 10846-T Tacoma, WA 98411 



CURRENT SUBSCRIBER 



.- Add two issues to ihu subseripiion. 

u Renew my subatrijjiioii. Payment is enclosed. 

a US'. :S20 us first Class: £24 D Can/Mcx- 


SM n Olhur Kiiriiigii 


S60 


ArfHrj-^s 






ripy St»\t- 


Zin 






KW - ., . - 


Pt 




Signature 




cps-t 



If you let your subscription expire, you nre cnnsirfered a NRW subseribei 

iind are NOT eligible foi llie fj^e issuu. 



NEW SUBSCRIBER 



^es, I lA^ant to s^ibscjibe to your fine pvibllnatinn. 
n US: $20 ire First Class: $24 D CanMex: S34 



II Other FDiBign: $60 





rMty 


Starn 


/.ip 






Country 














E^p. 




SirmatiirH 








CP34 



CURRENT SUBSCRIBER 



O Add two isaucs lo ihis suhscripriim, 

n Rtnuw my subscription. Paymcnl is enclosed. 

D US; $20 US First Class: $24 PI Tan/MtiKJ 

^/a^rtl* 


%^4 D OLher Foreign; S60 








Citv 


^iitip 


7.1^. 








'tS^ '9A' 




P.tp 






CPM 



If you Icr your subscription expire, you are considered a NEW subjicriber 
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Attention EAMON adventurers 

The Computer Learning Center is designing 
a NEW Public Domain Adventure Game System. 

And we are asking for your comnnents. How to improve on the traditional Eamon' is 
just one of our questions. If you have played Eamon games, tell us what you thinh could 
improve them. And if you have created Eamon game(s), tell us how best to improve 
the editor/dungeon maker. What are your complaints and praises? Do you have any 
ideas to offer the world of adventuring? Should scenario authors receive more than 
a mention on the title page of the adventure. Should graphics be used, or should they 
be more prosaic. What about parodies of popular adventure games, movies, TV shows.... 

Send your comments to: CLC-EAMOh FO Box Ii0876-T Tacoma, WA 98411 



■"^f^S^P^'l^^^ililflillilllilllplill 
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feature: 
19 More ROM Running 

This article lakes you by the hand through the ins and nuts of ROM.s and RAM cards. In 
addition, check.sum of ROMs and a patch to Don Lancaster's modified ROM arc explored. 
h\ WV.V Feltv 
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16 Infocom Revealed 

Finally, InCocom's technique for encoding Itie text in its adventures is exposed. This article 
details how Inroc-om (encodes its text and gives a .shurt program to allow you to snoop around 
your adventures, by George and John Bigelow •-■-- >■ 
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Please address letters to: 

COMPUT1ST 

Editorial Department 

PO Box 110846-K 

Tacoma. WA 9841 1 



Include your name, address and 
phone number. 

Correspondence appearing in tine 
INPUT section may be edited for 
clarity and space requirements, in 
addition, because of ttie great 
number of letters that we receive and 
the small size of our staff, a response 
to each letter is nol guaranteed. 

Our techinical staff is available for 
phone calls between 1:30 pm and 
4:30 pm (PST) on Tuesdays and 
Thursdays oniy. 



To Copy 40 Tracks 



In regard to Mr. Wayne Wat kin."), 
COIViPUTIST No. 29, page 5 &. 6. on liow to 
COPY A liis 4tl-ira(;k disk. I found th;it thi.s 
mcihod works nicely. 

1) Boot DjOS 3.3 System Master and load 
COPYA"s machine language part, 

PR #6 

BLOAD COPY.OBJO 

2) Enter ihc monitor atid modify this code to 
do 40 tracks. 

CALL -151 

jl«2:28 N 35F:28 

3t Save tfiis tiiuditlcd code 

RSAVECOPY.OB.T9,48,A!S2CO,LSIHIJ 

4) Return to HASIC ami loud COPYA. 

LOAD COPYA 

5) Modify COPYA by typing the following 
lines: 

70PRINTCHR${4}"BLOADCOPy OBJ0 40":REMS2C0 
75 POKE 44725. 160 ; POKE 461563. 40 ■ POKE 48894. 
40 

6) Save thi.s new version of COPYA. 
SAVE COPYA 4« IKACK 



7) Stan up this new version and break right at 
the >aurcc drive prompt, 

RUN 

8) Delete Lint- 70 -m that it won't reload the 
machine language portion. 

7ft 

<)) Enter the monitor and makttllfe following 
changed lo DOS; 

t:ALL -151 
B92F:18 68 

n9fiB:i8 m 

B92S:18 6e 
By88:18 69 
BE48:I8 

10) Stan up this, new version of COPYA and 
copy your 40 track disk., 

RUN 

I cannot takt; credit for steps 1 -6. The credit 
rests with Mr R. Boreiko. COMPUTIST No. 
21. page 5. You iiuty want to leave the room 
while COPYA 4fl TRACK ts copying as the 
noise could raise the dead. 

Incldentnlly, neither the softkcy iorKuniiciui 
nor Choplijh't: COMPUTIST No 23. would 
work for my version.s. Was there a bug in eillier 
one? 1 don't have COMPLTIST No. 24 to 
check. If there was a bug in either one, please 
print it in an upcoming issue. 

Marc Batchclor 
Lompoe. CA 

Mr. Batcliehr: Wf cunemly know of no bug 
in eilhcf the "Choplifu-r" or "Kiirateka" 

sojikeys. Hom'vi'r wfi haw noiln'c! thin ifw 
Karaieka soflkey iui well as most other boot- 
code »/jC(? xoftkeysj cannot be performed on a 

//c. 



E-Z Learner Softkey 



Requirements; 

Apple ][ Plus, //e 

One blank disk 

1) Boot the EZ Leyrner disk and before the 
menu comes up (about 4 seconds after boot, or 
until disk drive changes from running roughly 
to smoothly) press Reset once. If no cursor 
appears, press Re.sct again. If you still do [lot 
get a cursor, rc-bool and w.'ah a little longer 
before pressing Reset (hut still before the menu 
comes tip). 



2) Type the following; 
CALL-25153 

3) Type the following: 

LOAD E Z LEARNER Ol OS 

4) Type the Mlnwing: 

ITE-XT ;::KOME : NORMAL : PR#0 ; IM0 ; CALL 1002 ; 
BS = CHR$ (13) +CHRS(4) ■ ONERR GOTO 159 

5) Put the blank disk in the disk drive and type: 

INIT EZ LEARNER 

Keith Duff 
IVtansfietd, OH 



Speak Nicely About the Executor 



A few monlhs ago (COMPUTIST No. 24). 
you ran an ad by Crane Hill for a batch of utility 
programs culled '■Executor"" thai included two 
disk data recovery programs. At tiiat time 1 had 
been handling a lot of di.iks for our Apple 
Computer Club (over 400 members) Library 
which had been cieated and written by many 
non-Apple Disk II disk drives Ccompaliblcs") 
and. as such, many disks contained ghtches, or 
bad spot.s usually located between address 
prolog and epilog byte strinf?s. I found these 
glitches very hard to locate and even harder and 
more time consuming to identity and repair. 
When I saw Mr. Hill's ad for disk repair 
routines, t was very dubious that thcy would 
repair my disks because 1 had tried every 
method I had heard about and all the popular 
disk 7ap programs 1 could get my hands on and 
had spent many, many Iwurs trying to recovei 
bad disks - vvithout much success. So, when I 
wrote to Crane Hill for his sy.'iteni. I asked foi 
a money back guarantee if I couldn't recover 
ray (gotxl) disk data using his routines. Boy. 
wa.s I .surprised - he agreed and sent me a nice 
note with the package. And, best of all. the 
routines worked jusl as claimed! 

1 wtmld liighly recommend the Executor to 
any .serious Apple enthusiast In order to use 
the data recovery program ■Tweezer.s" it is 
assumed that the user has a working knowledge 
of DOS disk formats (I recommend "Beaneath 
Apple DOS") and has a software program that 
will identify bad sectors on a disk and nrake a 
working backup copy of a "bad di.^k" ignoring 
ihe ■■bad" sectors such as Copy jj Plus or the 
Locksmith Fast Copy nmtine from Locksmith 
5,0. 

In addition to the data recovery programs, 
the disk is full of nice, handy, little utility 
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piogianii. Tile settmd inujiir mility program on 
the Crane Hill disk h a program Lvilled 
"Cracker" thai stiN up ilic Apple lor boot code 
tracing and includes ihc fiinctioni of tlie 
Programmer's Aid (ulil F8) ROM, This Utile 
jewel is really handy to use for tracking disks, 
and Mr. Hill lias inleudcd a liltic tutorial 
exercise in the instruction manual that comes 
with the disk. 

Thanks fur running the ad. 

Ken Burncll 
Kingdom of Saudi Arabia 



j t!;opy J I Meets 

, Stubborn Controller Cards 



There is something c\ceedingly peculiar 
about the ProUOS that comca \vith Copy j[ Plus 
version 6.&. U will not hont(**L:NABLE TO 
LOAD UTlL.SyS'rHM*:K. KELOC/CONFIG 
ERR, etc.) on Kome niachines (two ditlerent 
Apple ]l Pluses) that 1 have tried it on, although 
those machines have been \yorking fine 
Otherwise. I traced the problem to the disk 
controller card I 1 found two disk com roller 
cards that work line with evcrythiny but this! 
One I tracked down to a partitulai LS32,'i & 
LS259 combination: the other I have not yet 
traced lo ihe IC level. My advice to anyone 
eiicoumering this problem is to first try a 
different T-ll.^S.'iy («34). 

Keith Davison 
>- Brookline, MA 



I, DAMIANO Softkey 



I would like to submit the following softkey. 
"I. DAMIANO" is an interesting graphics 
adventure ;^ame from Rantam .Software in 
which being evil usually makes things easier - 
until Satan catches up with you! Here's how 
Bantam pioteeled the disk. 

Using Tracer and linguist, one discovers 
normal formatting except for Hack SI 1 , which 
contains no useful data. The boot initially loads 
sectors tS to 5 of track Into 5800, this code 
loads more DOS into SB7(!!W from track 2. 
However, before this wc find a brief excursion 
to track $11, where ihe altered track is looked 



The deproteciion turned out to simply require 
disabling the subroutine that does the check, fo 
dcproieci "L DAMIANO" simply copy both 
sides of the entire disk with vour favorite quick 
copier, ignoring any errors on track §1 1 (the 
back side is nnprolecled). Then use a sector 
editor to find a JSR S0H.3r in track &, sector 
& On my disk I found the 20 3F 08 at byte $2 1 . 
Replace this with CA EA EA and you have a 
COPYAable unprotected backup. 

Now let nie make a request. How about an 
article on how to find nibble count routines? 
So inany of your softkey descriptions describe 
the disabling of nibble counts, yet completely 
ignore any discussion on how to find and 
identity the offending code. 

A. B. Riley, MD 
FPO San Francisco, CA 



More Wizardy Stuff 



First off. I would like to complement you on 
a superb magazine. Second, 1 would like to 
thank Black Rose for rising to defend fellow 
pirates tCOMPUTIST No, 26). Thirdly. I have 
a few art's for the Wizardry series, 

1) In COMPUTIST Nos, 28 and 20, there were 
other Wizardry APT's explaining how to create 
a "Snper Bishop" and in CO.MPUTIST No.l^l, 
to change the class to become a super -samurai, 
or lord. etc. Why go througli ail that, when 
[)dcntil>'itig # ."v and J will bring l(10fi,00fl.!Wl 
exp mid GP to the character below the Bishop 
doing the identifying. 

2) In Legacy of Llyigamyn, each character must 
go through the Rite of Passage Cereinony 
(making them 1st level, instead of 206 or so), 
I have found a way to defeat this major 
drawback, Pirsi. create an unmoriificfi character 
in Wizardry I. Then, using the transfer option 
of the Utilities, move the character(.s) to 
Wizardry III, Go through ihe Rite of Passage 
Ceremony. Transfer the character(s) back to 
Wizardry I. Use yoitr "Legacy" Bishop to 
bring these characters up the ranks (Identify 9, 
.1. S). After this is done, have them rest at the 
Adventurers Inn, and transfer them back to 
Wizardry HI. It is a good idea lo have I wo 
parties for Legacy, one dominamiy pood and 
one dominamiy evil. 

.1) Wizardry 0, The Knight uf Diamonds. The 
answer TO the Riddle of the .Spins is on the box 
cover, in the instruction book and at t,he 
begitming of tip #3, 

The Zwix 



Fahrenheit 451 Softkey 



I was recently glancing over a few old issues 
of COMPLTiS T when I came across a sottkey 
for Rendevous with Rama by Jeff Lucia in 
COMPUf ISf No. 19. page 5. I have ihai game 
as well as Fahrenheit 451. hotfi by the same 
company, and both share ihe same protection 
method. While the Rendezvous softkey will tiot 
work properly for Fahrenheit. I tested the 
program entitled "lO" and found the correct 
bytes to change. Here is the softkey for 
Fahrenheit 45!. 

Re(|iiirenients; 
Four blank disks 
COPY A 
Fahrenheit 451 

1 he proteaion used on Falirenheit is the same 
used on Rendezvous widi Rama, There is a 
nibble count on track S!0. So all we have to 
do is find the bytes that cheek for the nibble 
count, and defeat them, 

1) Copy sides two. three, and four using 
COPYA or any other normal DOS copier. 

2) Run COPYA and fix it so that it ignores any 
errors, 

RUN COPYA 

7» 

CALL -L^l 

8942:18 

3DBt; 

RUN , 

.1) Copy side one and don't worry about errors 
on tracks $3 or 510. 

4) Boot up a normal DOS after the disk is done 
eopving. Insert side one and load in the program 
called iO". 

BLOAD 10 

5) tnter the monitor 
CALL -151 

6) Change these bytes .so Fahrenheit doesn't 

check foi the nibble count. 

lBF9:2fl 29 IC 

(originally AD 82 CO. Note the Similarity 10 
Rendezvous) 
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7) Save lO back ro the disk. 
BSAVE IO,A$A0e,L$1512 

8) Y(iii now have a dc protected Fahrenheit 45 1 , 

Thank you and keep up the good work with 
the best magazine around for the Apple. 

fireg Poulos 
Detroit, MI 



The Hobbit & Beast War 



1 have been subscribing to COMPUTIST for 
a couple of issues now and let mc say that 1 have 
enjoyed it tremendously The softlceys ati^ne are 
worth the subscription priec. Here are a eoviplc 
uf hullkeys tjf my own that might be he!pfu) to 
Komeone. 

Dt'pnitecling The Hobbit 

Upon first inspection tiie disk seems to be in 
normal DOS .1.3 format. Logic dictates using 
COPY A first so I did. The copied disk boots 
Just fine but after displayitig the graphics page 
it sliuts the disk drive off and freezes. Since this 
is a COPYAable disk, it led me to guess that 
a nibble count had occurred and didn't like what 
it found. Booting tlic disk up once again, I 
waited until the disk drive shut itself off and 
then pres.sed Open Apple-CTRL-Rcset and 
CTRL Reset in rapid succession This left me 
in BASIC. Typing CALL -151 to get mlo the 
monitor . I checked to see if boot 1 (.starts at 
S801) wa.i, Still in tnemory. Since it was. I then 
followed the code and found it jumped to $200 
at S84A. Looking after $2t)0 I'found this little 
bit of code: 



223- 20 48 03 JSR 1348 Tfie protection 
subroutine? 
1%- A5 91 LDA $01 get location 101 
228- F0 03 BEQ |220 Branch to S22D If 
Ylk 4C n 02 JMP S22A Loop forever 
22D- A9 03 LDA M03 Cont ina.e ^^n ICfidJ rsg: 

After returning from the subroutine at SMS, 
the program checks memory locution $01. If 
a zero is there, everything i.'^ fine and the 
program eontinues to load in, Howevei, if 
anything else is found control passes to $22A 
which in machine language is the same thing 
as 10 GOTO 10 is to BASIC. All we have to 
do now is change the LDA $01 to Load A wuh 
a zero and the protection i.s hi.story. Another 
victory in the Deproiection Warsll 



Step by Step Instructions 

1) COPY A both sides of the original Hobbit 
disk; 

2) On the front side, sectot edit Track $00. 
Sector $01. Bytes $26-27. from A5 01, to A9 

00, 

3) Write the sector back to the disk and that's 
all you have to do because the back side is 
unprotected. 

Beast War 

This one was easy. Just ttse the SWAP 
controller and the resulting copy works like a 
champ. The one change I made to my copy was 
to add a -fast" DOS (like Diversi-DO'S) to 
.speed up the booting and Ills loading. 

Step by Step Instructions 

1) Initiali/.e a .slave disk, preferably with a 
"fast" DOS. iind DELETE the Iiello program. 

2) Boot The original Beast War disk. 

3) When the program prompts you to input your 
name, take out the Beast War disk and replace 
it with your initialized disk (but don't close the 

disk drive door yet!). 

4) Follow die program" ^ prompts. 

5) Ttie disk drive will turn on for a second, 
rattle, beep, and then drop you into BASIC, 

6) Gel into the monhor. 
CALL -151 

7) Move the BEAST WAR RWTS to a safe 
location, 

l9ee<BS09.BFFFM 

8) Close the disk drive door and boot your 
tnitialLied disk. 

9) Save the RWTS 

BSAVE 
RWTS,BEASTWAR.A$19M,LS8eB 

10) Make these changes to your SWAP 
controller before you eopy the BEAST WAR 
disk: 

I010TK=^3 : LT:;35 : ST=lD ; LS=lb : CD=HR : FAST=1 
10010 PRINT : PRINl CHRI(4 ) "BLOAD 
RffTS.BEASTWAR, AI!90e" 

11) Now use your SWAP controller to copy the 
BLASl WAR disk and you're all donel 

Jim S. Hart 
JacJisonville. NC 



Waeted 

List 

Need help 

backing-up a particularly 

stubborn program? 

Si^nd Q5 the ncime of the prayrflrn iind its 
mt5nLi[iii.-turs.'r and wri'll sdd ll to ouf Mo.'it 
W^riled I.tst. s column (updated each issue) 
whidi helps to keep COMPUTIST readers 
informed of the programs for which soft keys 
are MOST needed. Send your requests to: 

COMPUTIST 

Wantod Li.<:t 

PO Box 110816-K 

Tacoma. \WA 98411 

If you know hoLu to deprotect 

unlock, or modify 
any of the programs billow, 
let us know, You'll be helping your fellow 
COMPUTIST readers and earning MONEY 
at the same time. Send the Information to 
us in article form on s DOS ,3.,^ d!skett.£f. 

MmiM' C?iik' AppU' L^?]iipuLL'r 

^liplt Kusliir.vs (iraplik% Apple Diaipuici 

,lane Arkirimics 

Visible nd Mkrolab 

Cat^ly.fl^ Ouark. In?. 

CulcnhurE Jr. 8; Hr. Mitfoiiuttion LiD 

ftiiiic Plotler Primixiift Corp. 

Tfi« Handlers Silicon Valley Sysiums 

Tin: .Applet Cure: Parts 1-3 Ttn- Piofcs^iir 

Fun Bunch UnicJ>rn 

W illj Rylt ... DliW Tick 

Cranstnii ,Vtiiniir Sicrr:] On-Linc 

.Snoizizlt: BrodcrbuntI 

Ho hot War Muse 

VBM Mu::e 

Al^'chess II DuMliui^t 

Story TrtH' SehoLislic 

Ae«il IL.S.A, SeholiiMic 

HiHidk'uppinR System Srnr"- Judge 

Dalhirs & SvWfK Mniiirgijjrn 

httui Flu.>i Agriiiiiit Syntmis 

Great Cruss Country Road Race Aqivisiirn 

Raster tltaistcr Bud^c Inr, 

Odin OdvBtu 

Mj^ti^rs Maiilitiii D^Euiii^v^i 

Brain Bank Tlii; Ob.',i:vLii(irj 

Undtr FIrt' Avuli^n Hill 

CHmwin (Irrni^n Pi:[i^uij[ 

Trypl iif Media Sil Tsxli 

v.\yo )v utii.ci> Miv.-r,™^iEv 
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readers' loftic ey A copy exchange 



M. M. McFadden 's suftkey for. . . 



Rescue at Rigel 



Ep\x 

1043 Kiel O. 

Swuiyviite, CA 94089 

Reqiiircmt'nts: 

MLif-FiN iroiii DOS 3.3 system masier 
A hhmk (or 1/4 empty) disk 

Rescue :it Rigcl is piobably uiie (jflii; first 
Automated Simulations programs to bu 
published through Epyx. Being five yeurs old, 
the copy protection is not exactly extreme. 

A (jtiick examination will) Ti'itA (from the Bag 
of Trie ks disk) shows that, although it is almost 
standard DOS .V2. the data prologue marker 
lluetuules. Searching through the RWTS 
routines. I di.scovered that the value for ihe last 
byte of the data marker prolof!ue i.s contained 
in KCro page memory location Si I , Why there? 
It is unaffected by Applesoft, but is zeroed when 
the monitor is in u^e. This way. it is impossible 
to use DOS while in the monitor (which not only 
screws up attempts to get into the moniuir. but 
also makes it hard to use In a Swap controller 
with Super JOB), 

Anyway, the fastest way to copy thin is to 
use the procedure for Morloc's Tower in 
COMPUTIST No. 22. Here it is. step by step, 
with the typos from that softkey corrected. 

1) Boot the .System Master disk and loud 
MUFFIN. 

BLOAD MUFFIN 

2) If yoti have a regular DOS 3.3 disk with ai 
least 130 free sectors, in.sen it now and skip 
to step 4. 

3) Insert your blank disk now and format it. 
INIT HELLO 

4) Get into the monitor, 
CALL -L*;! 

5) Modify MUFFiN"s RWTS .so thai it ignores 
the last byte of the data prologue. 

1AIC:29 ee 

6) Start up MUFFIN. 

7) Use " = "■ (a wildcard) for the filename and 
tran.sfer the tltes from your Rescue at Klgel disk 
to your DOS 3.3 disk. The first file MUFFIN 
will come lo is HELLO, You may wish to 
rename this file as RIGEL Just to distinguish 
it as part of Rescue at Rigel. 



Yotinow have a working, fully brokejiT®py, 
To .start it, just SUN the HELLO program, or 
RUN RIGLL if you changed the name. 

This same procedure will also work for 
lielltirc WaiTior, and it should work for .some 
of Epyx' other early releases^ such as Temple 
of Asphal and .Sorceror of Siva . 

^ 

Tony Pbalen 's sofikf^y for... 



Paul Chan Shun Ho \ softkey far. 



Crazey Mazey 



Datama.si, !ni\ 
8943 Fidlbn^lu Aw. 

Ckamvmh, CA 913 il 

Requirements: 

4RK Apple II 

A blank disk 

COPYA from DOS 3.3 System Master 

A sector editor 

Crazey Ma?cy dls^ 

CraKey Mazey is a fun little arcade type 
driving game. "I "he object is to out maneuver or 
outrun the chase cars while tiding to pick up 
as much money as possible. Dollar signs (S) are 
placed in the full screen maae and you must luu 
over them to pick them up. 

To makji a working copy of Crazey Mazey, 
follow the steps below: 

1) Insert your copy of the DOS 3 3 System 
Master and tun COPYA. 

RUN COPYA 

2) Once loaded, stop the program with |_1C) . 

3) Delete line 70 to keep the binary file from 
being reloaded. 

4) Enter the monitor and patch DOS to ignore 
data and address epilogues, read eiTors, and the 
third byte of the data header, in that order, 

CALL-151 
8925:18 60 

B98!J:I8 m 

BE48rI8 

BSFLiHfl 

mm 

5) Restart COPYA by typing RUN imd make 
a copy of Crazey Mazey. 

6) After you copy the disk, boot up your sector 
editor. Edit track 0, sector 3, and change byte 
S42 from S3 8 to SIH leh;ingiiig a SEC to a 
CLC) This keeps (he computer frotn getting 
stuck on track Pi because of errors. 

That's it! Boot up and enjoy! 




g 



CkUtt.wft 
19ms Nordlwff Place 

Ckni.wm-th . CA 91311 

Kequirenmnts: 

Apple ft Plus, llii or //c 
One disk drive 
Two blank disks 
Super lOB vl..i 

Conan is a s.reat game inspired by a famous 
film and ,series of .stories. The inission is to find 
and slay awesome creatures in a quest of wealth 
and glory. There arc seven screens and levefs. 
In my opinion Conan is one of the best games 
in my Apple library. 

Just like all other Daiasoft products. Conan 
is he.ivily protected. Conan is a double-sided 
di.sk; one .side i.s the program side and the other 
is the data side. 

Fortunately, the disk is fairly norma! , except 
that the addre.ss header and end mark had been 
changed on bodi sides and there is a nibble 
count on track .^10 of the data side So. we can 
use Super lOB and perform some sector edits 
to dcproiect it. Since tlie nibble, count check 
routine is on the program side, wc only need 
to perform a sector edit on the program side. 

The nibble count roiifinc is loaded froni track 
S0, sector Si into memory starting at $B700 
with an entry point at ^B73 1 . The routine first 
seeks die drive head to track %\V), turns on the 
drive, then checks for a byte pattern on die 
track. If the checking is successtiil. it will [timp 
to $A00O. Otherwi.se it will jump to a routine 
to clear the memory and reboot. Therefore we 
can place a jump to fSAttCia al the start of the 
program (SB731). and dksable the routine. 
Moreover, there are many bad sectors on the 
disk, i u^cd the "'ignore unreadable sectors" 
routine ol Super lOB to copy the disk. 

Step By Step 

I; Copy the program side of Cphan vi-ith the 
progiain side controller fbelowl installed into 
Super lOB 1.5. 

2) Copy the d.'tta side using the data side 
controller. 

When Super lOB is finished deprotecting the 
prt^gram side, it will have performed the 
tol lowing sector edits: 
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readers' softk ey & copy exchange 




he si|HHet;r^ of this exquisitely 
urn i shed liuing rooH is ruined by an 
verturnedc goldplated statue and the 
halk outline of a dead body — gruesoHe 
reninders of Hhy you are here. 

EXAMINE THE BROKEN STATUE ON THE FLOOR 

The statue J of a HOHan transforHing into 
a tree^ lies broken on the floor. Tiny, 
bolden leaves are scattered around Hhere 
It fell. The inscription at the base of 
the statue reads, "Daphne". 



Track 


Sedar 


Byte 


FrOffl 


To 


$00 

$00 
$00 


$00 
$09 
$09 


$E9 
$CD 
$02- 


iCC 
S96 


SD5 
$AA 
t96 


$00 
$00 


$01 
$01 


$31 
S33 


$A9- 
$8D 


S4C 
$A0 



controller checksums 



The first block of sector edits tells Conan to 
accept normal address markers, the nexi teils 

Conan lo jump over the nibble cuiini roiilint; 
diret'ily lo the entry point of the program. 

Wow[ll You now have a COPY A able Conan 
disk. 



program side controller 

1009 REM OTAN PROGRAM SIDE 

1010 REM IGNORE 1ST ADORbSS END 
1020 POKE 47507 ,0 

1030 POKE 775 9S : ONERR GOTO 550 

1040TK=0 LT=I :ST=15 :LS=15 :CD = WR :FAST 

= 1 
1050 GOSUB 490 :TI = TK : I F TK = THEN GOSUB 610 

:LT = 35 :TI^- 1 
1060 RESTORE ; GOSUB 190 : GOSUB 510 
1070 TK = PEEK (TRK ) : GOSUB 310 : GOSUB 230 . 

GOSUB 490 :TK = T1 : GOSUB 610' IF PEEK (TRK 

) = LT THEN 1090 
1080 TK = PEEK (TRK) :ST = PEEK (SCT) , GOTO 1050 
1090 HOME .PR I NT "PROGRAM' SIDE' COPIED" , END 
1100 DATA 204 150 ,170 
Ulfl DATA 5* CHANGES 
1120 DATA ,0 ,233 ,213 .0 ,9 ,?05 170 
1130DATA0 ,9 ,210 ,150 .0 ,1 ,49 ,76 
1140 DATA ,1 ,51 ,160 



1000 


- $356B 


1089 


- SFECB 


1010 


- $1270 


1090 


- $A64B 


1020 


- S508A 


1100 


- S3A51 


1030 


- 5F74E 


1110 


- S4224 


1040 


- 59065 


1120 


- IB8BF 


1050 


- SElFa 


1130 


- $C406 


1060 


- 5245E 


1140 


' 56845 


1070 


- S6C62 







data side controller 



1000 REM CONAN DATA SIDE 

1010 REM IGNORE 1ST ADDRESS END 

1020 POKE 47507 ,0 

1030 POKE 775 ,96 ONERR GOTO 550 

1040TK = :LT = 35 ;ST=lb :LS = lb :CD:WR :FAST 

= 1 
1050 RESTORE , GOSUB IM ■ eOSUB490 : GOSUB 610 
1050 mSUB 230 , GOSUB 490 , GOSUB 610 , IF PEEK 

(TRK) -LT THEN 1050 
1070TK = PEEK (TRK) ■ ST = PEEK (SCT) : GOTO 1050 
1080 REM RECOPy TRACK SECTOR 
1090 TK = :LT = 1 :ST. 'LS = 15 
1100 GOSUB 490 , GOSUB 510 
1110 GOSUB 490 : GOSUB 510 
1120 HOME : PRINT "DATA" SIDE" COPIED" : END 
1130 DATA 204 ,150 .170 



controller checksums 

1000 - S356B 1070 - SF696 
1010 - il270 1080 - S25B3 
1920 - Se0aA 1090. - SAS2D 



1030 - SF74E 

1040 - SF53E 

1050 - SB4B7 

1050 - J8E22 



1100 - $8830 

1110 - $310A 

1120 - $6E6a 

t!30 - SA743 



% 



Charles S. Taylor's softkey for. 



Perry Mason: 

The Case of the 

Mandarin Murder 



Ti'kuium Coij>. 

One Kendall Square 

Ciimbridgc. MA 02139 

Reqiiircmcnls: | 

Di.'^k Muncher 
A SQCtor trtlitor 
FdLir bl;irik disk sides 

Todeprotcct PERRY, I adapted the method 
used on Rendezvous With Rama by Jeff Lucia 
in COMPIJTIST No. 19. 

Sides two. three and four arc all inipruiecled 
arid can be copied with any fast copier. Side 
one is sensitive to the copier used. 1 achieved 
about a M% success rate using Disk Munehcr 
to copy side 1 and making the following sector 
edits: 

Track Sector B/te From To: 

$17 $0B $5e JAO 520 

$17 $0B S5D $32 529 
$17 $0B S5E $C0 $IC 

1 found the same byte sequence of AD 82 C'0 
ill several ottier places on the disk; however, 
changing them is unnecessary. 

. ± 

Contach 's softkey for. . . 



Koronis Rift 



EpvJt Cimiptiti'r Sufhrure 

' J 043 Kiel Court 
Smmyvule, CA 94089 

Rfquirements: 

48K Apple |[ and up 

COPYA 

Ori):inal Koronis Rift disk 

A sector editor 

A blank disk 



m' 
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readers' softk ey & copy exchange 



The rirst thing that i do when I buy a program 
is try to back up ihe program. I espcciaMy waiii 
to do so if the program writes to itscit. I was 
able to make a eopy of the program using a 
popular bit copier. However, the copy was not 
very reliable and I felt there was a better way 
of batkiny up the dl.sk. With a little bit of 
snooping it looked like the proteetion could be 
easily removed. 

The first thing that I did was observe the boot 
proees,-;. 1 did not notice anything umi.sual 
except there was no cursor. This was :ioi bad 
but it meant that there were probably no files 
on the disk. After I did not see anything unusual 
with the boot, I decided to look at the disk with 
a sector editor. I got (he sector editor running 
and tried to look at a sector I chose at random. 
This produced an error from the sector editor. 
I tried turning the checksums off on the sector 
editor and read the same .sector. This time 1 was 
able to lead the seelor. Knowmg this, I tried 
running COPYA ignoring the eheckstmis 

I tried booting the copy that 1 had just made. 
The program would start to load but h would 
reboot after a ccrtam point, This looked like 
a nibble count and I decided to try to find it. 
Since I knew the disk would fail a test and 
reboot. I ran my sector editor and scanned the 
disk for a SC6M (as in JMP $Cm&) by looking 
Tor the byte.s 00 06. This is where the program 
would have to jump to reboot. The scan 
produced two of them on track IC. After 
looking at the code. I eliminated one ot them. 
The next trick was finding the code that jumped 
to this location. With a little bit of looking. I 
found the nibble count on the same sectoi , The 
nibble count had several branches to the reboot 
routine. I defeated the nibble cot ml by changing 
these branches to jump to where the nibble 
count returns the control back to the program. 
1 wrote the sector back lo the disk and booted 
the disk. The disk booted and the program 
worked perfectly. 

This i.s pan of theeode for the nibble count: 



1585- 
15S7- 
1589- 
158B- 
158D- 
1590- 
1592- 
1594- 
159G- 
1597- 
1599- 
159B- 
159E- 
15A0- 
15AI- 
15A3- 
15A4- 
I5A&- 



F0 IE 
C9 EE 

D0 H 
A0 07 
BD 8C C0 
10 FB 
m 48 
D0 0F 
S8 

10 F4 
A2 00 
BD 00 08 
95 00 
CA 

00 F8 
18 

m 

(start of 



BEQ M5A5 
CMP S}EE 
BNE $157F 
LDV SWI 
LDA CG8C.X 
BPL SI 530 
CMP (S48),Y 
?M S15A5. 
DEV 
BPL S15SD 

LDx ms 
LDA %mm.x 

STA {00, X 
OEX 

6NE S159B 
CLC 
RTS 
reboot code) 



If the branches ai .SI -IS.") and SI 594 are taken 
(meaning a bad disk), the program goes to the 
code at SI.^A5 and eveniiially reboots or hangs. 
OUierwise, Lhe program ends up at S1599 where 
some memory is copied down to the zero page 
(■$00O0-$00FF) and then returns to the calling 
program. 

Every branch to $15A5 should be changed 
to branch to S1599 in.sieari. This means 
changing the second byte of the branch to a new 
value. Calculating the new length of the branch 
is a mailer of counting the number of bytes 
between the old address and the new address 
and subtracied from the current branch length. 

For example, the old address is Si5A5 and 
the new address is $1599. The offset between 
these addresses is $flBf$15A4-$1599 = $00). 
The byte at S 1595 (the second byte of Lhe BNE 
instruction at $1594) is changed from $flF to 
%m ($CIF - $0B = Sm). This is done for all 
the branches going to $15A5. 

Step bv Step 

1) Get COPYA into [iiemory. 
RUN COPYA 

2) When it asks for the slot and drive mmibers, 
stop the piogryin with 



3) Go into the monitor and tell DOS to ignore 

lhe checksums and epilogs when reading. 

CALL -151 
0925:18 69 
B9SS:1S 60 
RE48:I8 

3Dec 

4) Delete line 70 from COPYA and copy the 
disk. 

79 
RUN 

5) Run your favorite sector editor and read track 
SIC. sector $E. 

6) Change the following bytes. 

Byte From To 



.3E 


66 


5A 


43- 


61 


55 


53 


51 


45 


61 


43 


37 


6E 


35 


2A 


77 


2S- 


21 


86 


IE 


12 


95 


0F 


03 



7) Write the sector back out to the disk, 

8) Enjoy the game. 



i 
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'' Antique sojtkey for... 



Cirisis MometaiiA 



I 4 



bv Rene Gaudet 



SviU'i-gixlic Sitfinrirf 

8M N. Rivei-i-iik' Dim-. 
Rauim, WA 98055 



Siiitf 2§1 



Rtquirements: 

Crisis MiiiiniHiti 

A bliinl< dish 

Super lOB i -^ 

A sector editor (optioni.il) 

A vtny to enter the moniior (oplional) 

Crisis Moiiniiiin is a variation ollhc Donl^ey 
Kong gciirc of giirTi(.'s. Tde object ot the g;imc 
h to defuse bombs in the caverns ot an aelive 
volcano while jumping, dodging, and avuiding 
boulders and a pesky radioactive bat named 
"'Bcnrum,'" 

The Problem 

Crisis Mounlaii) is protected software and has 
been on the Most Wanted List for ihrec niontiis. 
i have nevtr de pro tec ted any software before, 
but 1 own a copy of Crisis Mountain. I decided 
the time had come when 1 should learn to 
dcproteci my own software. 
\ I will begin by explaining the procedures I 
used to deprotect Crisis Moitniatn. 

Friday 

The weatherman said that it would be rainy 
all weekend, so I brought out my copy of 
DiskViow (a nibble viewer) from COMPUIIST 
and took a look at Crisis Mountain. After two 
hours of examination, I learned about sync, 
address, data, and ch^eksuin bytes, and what 
1 discovered is illustrated in table I. 

Armed w'ith this knowledge. I wrote a 
controller for Super lOB. Unfovttmately- the 
controller wouldn't work and 1 kepi getting 
"Drive Errors". After spending two more 
honrs trying to get the controller to work. I got 
frustrated with my luck of progress and quit for 
the night. 



Marker 



Table 1: 



DOS 3. 



Crisis Mtn. 



Start Acfdress 


D5 AA 96 


D5 AA 96 


End Address 


D£ AA 


FF FF 


Start Data 


D5 AA AD 


D5 AA AD 


End Data 


DE AA 


FF FF 


S/nc By'e Before 






Address UarK 


FF 


EB 


Sync Byte Before 






Data Mark 


FF 


AB 



Saturday 

Still rainint! outside. I went back a> the .-^pple 
with a new plan; boot code tracing. Three hours 
later, I was perplexed at how any program could 
ever run on this blasted little machine. I noted 
that my knowledge of the inner workings of 
DOS was serioitsly lacking. Reading through 
hack issues of COMI'UTIS f. I cat lie across the 
method of capturing a program's RWTS 
(Read /Write Track /Sector) section and 
ineorporatitm it into a Super lOB controller. 
Also, in an Input letter in COMPUTIST No. 
25, Brian Snouk described a way to enter the 
monitor with a IWohm resistor. Radio Shack, 
here I c(^me! I put down my twenty cents for 
two 100 ohm resistors and, on ihe way Itome. 
I stopped at my local computer store to pick up 
a copy of "Beneath Apple DOS" by Worth and 
Lechiier to help my understanding of Apple 
DOS. 

I booted tip Crisi.s Mountain and popped into 
the monitor with my resistor by connecting it 
between pins 26 and 29 (any slot except the 
auxiliary slot on the //c) and moved the RWTS 
to $1900, Then 1 booted DOS -"^.3 by typing 
C6mV3 and BSAVEd it to my Super lOB disk. 

With the Crisis Mountain RWTS. I used the 
standard fast swap (NcwSwap) controller with 
Supei lOB t.5 to copy the Crisi.s Mountain 
diskette , The copy of Crisis Mountain would 
not boot. Cataloging the newly created diskette 
.showed no files, so 1 decided to read "Beneath 
Apple DOS" and try again the next day. 



Sunday 

1 searched the disk for any signs of the 
VTOC, catalog, and track/sector lists of files 
i f there were any (Refer to your DOS inantial 
for more infonnation on diskette orgunij^attoii), 
I only found track /sector lists, and the VTOC 
and catalog sectors normally found on track 17 
(Si I J were entirciv zeroed out, I rebuilt the 
VTOC and two catalog sectors by making a 
simulated catalog entry for each possible 
track/,sector li.st that I found. However. 
rebuilding the VTOC did not help dcproteci the 
program because Crisis Mountain acces.ses the: 
track/sector lists directly from the program, A 
rebuilt catalog will help readers who wish to 
develop Advanced Playing Techniques (cheats) 
for the program, borexatnple, files "B" and 
"K" (my names) are the two different playing 
field screens. 

Using DiskEdit (a sector editor) frorh 
COMPUTIST, 1 compared Crisis Mountain's 
RWTS to the DOS 3.,^ RWTS and came up with 
the following difference.!;: 

SAddr Trk.Sct.Byte Crisis Mtn DOS 3 3 



BB3E 


0,2.3E 


AB 


FF 


B84A 


0,2,4A 


A9 


48 


BB4B 


2,4B 


AB 


68 


6840 


0,2,4D 


SD 


89 


B84E 


0,2.4E 


B7 


B8 


B89E 


0.2.9E 




DF 


B8A3 


0.2, A3 




AA 


B3A8 


0.2, AS 




EB 


B935 


0,3.35 




DE 


B93F 


0.3.3F 




AA 


8991 


0.3.91 




DE 


B99B 


0.3,9B 




AA 


EA29 


0.4, 29 


M 


96 


BAAA 


0,4.AA 


m 


AA 



On the copy of Crisis Mountain, 1 applied 
the Apple DOS values li.stcd above into the 
Crisis Moutuain RWTS. The diskette still 
would not boot. Browsing throttgh the Cri.sis 
Mountain RWT.S [ found some code in what 
is supposed to be the DOS primary buffer 
($BBM-SBBFF). Disassembling Hie sector with 
the "B" command in DiskEdit showed a read 
to the diskette with the old sector marks. The 
following patch was applied to correct the read: 
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COMPUTIST No. 34 



SAddr Trk.Sci Byte 
BB24 0,5.24 



Crisis Mtn 

ES 



DOS 3 3 
FF 



After applying the above change, the copy 
of the program would boot. run. and was 
copyable. 

Summary 

I iini sure thtit Komeono with more experience 
a)uld have dcprotccted Cri.sis Moumain in a 
more simple or elegant manner, but llu.s was 
my tlrsit attcmpr to deproteci any software. In 
eonelusion. don't wail tor terrible weutlier 
be lore you try to deproteet sottware. Who 
knows, you might even learn someiiiiiig {like 
1 did). I highly recommend the beginner get the 
following tools; A sector editor (tike DiskEdit), 
a nibble viewer (like DiskView or The Nihblcr), 
•'Beiit.-itth Apple DOS" by Don Worth and 
Pieier Lechner for valuable DOS information, 
and back is^ue.s of COMPUTIST to observe 
m et hod.s of deproteet ion . 

Step By Step 

1 ) Start by ereating a KWTS ta read the Crisis 
Mouiiiain diskette. Boot a DOS 3.3 diNkette. 
Enter the monitor and copy (Myve) the nyrmal 
RWTS 10 lower memory. 

CALL -151 
I9fl9<B8fl8,BFFFM 

2) Change the normal disk reading vulucb 
(prologues, epilogues, and sync bytes) m the 
RWTS in the Mtrange ones. 

I93E:AB 
199E;FF 
19A3:FF 
1!».A8:FF 
1A35:FF 
l.UF:FF 
1A91:FF 




IA9n:FF 

lBf»9:AA 
inAA:B8 

3) Return to BASIC and save the new RWTS 
to your Super lOB disk. 

3DBG 

BSAVE Rwts.dRi!^^,i$j«toe.L$sfle 

4) Here's the .Super lOR controller to do the 
rc.rt of the work. Just install it into Super lOB 
1.5 as usital and RUN it. 



controller 



1000 REM CRISIS HOUWTAIN CONTROLLER 
1010TK=0:LT=35 :ST = 15 LS=15CD = WR FAST 

= 1 
10Z0GOSUB350 .GOSUB490 . GOSUB610 : IFTK- 

FHti^HtSIORb , i;OSUB310 
1030 GOSUB 360 : GOSUB490 : GO3UB610 : IF PEEK 

(TRK ) =LT THEN 1050 
1040TK = PEEHiTRK) .ST = PEEH (SCT) :GOTO1020 
1059 HOME : PRINT "COPY* DONE" :NED 
1500 DATA 15' CHANGES 




1510 DATA 


2 .62 255 






1520 DATA 


,2 .74 ,72 






1530 DATA 


.2 .75 ,194 






1540 DAI A 


.2 .77 .185 






1550 DATA 


.2 ,78 ,184 






1660 DATA 


.2 ,158.222 






1570 DATA 


.2,163 ,170 






15S0 DATA 


2 ,158 ,235 






1590 DATA 


3 ,53 22? 






1600 DATA a 


.3 .63 .170 






1610 DATA 


3 ,145 .221 






1620 DATA 


.3 ,155 ,170 






1530 DATA 


.4 ,41 ,150 






1640 DATA 


.4 ,170 .170 




1 • 


1550 DATA 


,5 ,36 ,255 






10010 PRINT CHRS 


(4 


) "RL.OAD* 


RWTS CRISIS AJ1900' 






controller checksums 


10S0 


- i355B 


1360 


- SAMA 


1010 


- 52544 


1570 


- SF621 


1020 


- 513BE 


1580 


- SCD0E 


1030 


- IS.A2A 


1590 


- S6312 


1040 


- $8B66 


1600 


- 551^7 


1K0 


- SC511 


1610 


- SC94E 


1500 


- i3EEC 


1520 


- SE91B 


1510 


- SDtS2 


1530 


- S733A 


1520 


- 5SAA3 


1640 


- 59284 


1530 


- 53C88 


1550 


- i6S0B 


1540 


- 5C34D 


10010 


- S5195 


1550 


- S7C64 
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softkey for... 



V. 



eri^aoLn 



'p 



aJLo 



^o 



by Tom Moore 



Terrapin, Inc. 
380 Green Street 
Cambridge, MA 02139 
$99.95 



Requirements; 

64K Apple D 
Super lOB 1.5 

Logo is an interpretative computer language 
which is becoming quite popular in classroom 
education. Terrapin Logo Version 2.M is a 
staie-of-the-an extension of the original M.LT. 
version. All Logos allow tlie user to rnuiupulate 
a "turtle" cursor (Terrapin uses a triangle) 
around the monitor screen. Version 2.00 
includes not only an agile, multi-colored turtle, 
but also full-language features such as 
mathematical functions, musical commands, 
and word and list-handling capabilities. 
Terrapin's latest Logo seems to he a real 
traiiblazer in the world of specialized computer 
languages. 

The manual's sections on backups ($15 per 
disk after a short time), warranties (tough luck), 
liability (they're not liable) and copyright 
notices (if MIT doesn't own it, Terrapin does) 
blaze new trails for the English language too. 
One indigestible sentence tells you uot to copy 
anything in the package, while another 
jawbreaker graciously allows you to copy the 
utilities disk and ' 'die computer programs listed 
ill the documeniatioQ", for persona! and 
archival purposes only. Since the documentation 
mentions the l^go program, the language disk 
should be copy able, right? 

Meet Catch $22, so to speak; Terrapin has 
heavily copy -protected the Language disk. Bit- 
copiers byte the dust. (E.D.D. W, Locksmith 
5.0G, Nibbles Away n C2, Back It Up m, and 
Copy II Plus v5.3) Logo v2.00 is on some 
parameter lists (nomial settings) but apparently 
that only means that someone got lucky once. 
Copy cards usually work well on a siiigledoad 
program like this, but my Wildcard was unable 
to recreate a functional Logo, 
^ Disk analysis reveals two Track sectors 



filled with D2 marks, a hint that a nibble count 
occurs during the boot. At Track 0, Sector 8. 
data headers change from normal D5 AA CF 
to I>4 A A CF. A disk "quick- scan", such as 
found on Locksmith 5.0 or Copy U Plus 5.3, 
shows that bit-insertion technitjues are also 
used-panicularly on Track Sll, the catalog 
track. Sectoring looks normal, and a brief 
Applesoft prompt appears during the boot. 

The normal sectoring and the brief prompt 
are clues that the Logo DOS uses an altered 
Read/Write TrackySeetor format. The Super 
lOB program has a "swap controller" option 
diat usually works nicely when you can capture 
an altered RWTS. It works fine for Logo-and 
wiUi a few pointers from the iOB coach, you 
and your turtle can leave the copy -protect ion 
hare in the dust! The following procedure will 
completely deprotect the Language disk. You 
can then combine it with the Utilities disk or 
upload it to a hard disk at will. 

The Language disk contains two binary or 
"B" files: SDOS (6 sector.s) and STARTUP 
(138 sectors). The HELLO program is SDOS, 
SDO.S checks for a 64K machine, displays a 
"Loading, please wait..." message, loads 
STARTUP, restores normal DOS, and finally 
jumps into STARTUP, At that point LOGO i's 
on line (the starting line?). The LOGO RWTS 
is captured during die time that SDOS is loading 
STARTUP, but before normal DOS is restored. 
Loading 138 sectors takes a long time, so this 
is an easy big game hunt. After capturing and 
saving your trophy, the LOGO RWTS, the 
deprotection of the Language disk is duck (er, 
turtle) soup. 

Here's how to put track shoes on your turtle, 
with the "Liberate LOGO" procedure that the 
manual forgot: 

1) Boot the Language disk, and wait until the 
"program loading" message appears. At this 
point the LOGO RWTS is in use, 

2) Press Reset or Control-Reset twice in quick 
succession- while the disk drive is rumiing. The 
first Reset will cause an automatic reboot. The 
fast, second Reset halts the reboot, leaving the 
LOGO RWTS intact in memory, 

3) Move the LOGO RWTS to the game 
preserve (sorry- "safe memory area") used by 
IOB: 

CALL -151 
19»B<B8ee.BFFFM 



4) Insert your IOB program disk, and boot it: 
CMdG 

5) Save the LOGO RWTS on the IOB disk: 
BSAVE L()G().RWT.S,A$19e»,Lilt8ft0 

6) Remove the IOB disk, and prepare a blank 
disk by initializing it with normal DOS 3.3: 

NEW 

INIT HELLO 

DELETE HELLO 

7) Run the IOB program with the swap 
controller at the end of this article. This will 
read the LOGO language disk out onto your 
newly initialized disk. Do not use the "formal 
disk?" option. 

8) CATALOG your new disk to verify that you 
have two files. SDOS and STARTUP. 

9) There is lots of room on this new disk for 
everything on the UtDities disk. Write protect 
the Utilities disk, and transfer the Utilities 
programs over by usuig a "copy files" 
program. (FID from the System Master works 
fine, but a "contiguous copier", such as the 
Copy 11 Plus "Copy Files" option, will lay the 
files down in a faster-reading otder on your new 
disk.) Use the wildcard option by typing an 
eriuals sign, " = ", when asked for "file 
name?". 

10) Finish your disk by replacing the old 
HELLO program, which came across from the 
Utilities diskj with a new HELLO program to 
call SDOS: 

UNLOCK HELLO 

NEW 

le PRlN'l CHK$(4);'BRUN SDOS" 

SAVE HELLO 

H) Boot youxnew disk and you should find a 
COPYA mrtie waiting for you! 

Notes 

Steps 1 and 2: If the IOB program can't rtad 
the Language disk, you perhaps waited too long 
before Resetting, Don't let the "?" Logo 
prompt come on. 

Step 6; Make sure to imtialize your new disk 
with a NORMAL DOS. If in doubt, it's worth 
the effort to boot your computer with your DOS 
3.3 system master before typing "NEW" and 
initializing a biank disk. When SDOS restores 
normal DOS, a "speed DOS" such as Diversi- 
DOS gets scrambled. (If you want a 
turbocharged turtle, judicious surgery on the 
SDOS file may be needed.) 

controller 

1000 REM TERRAPIN LOGO COMTROLLER 
1010TK=3:LT = 35ST=15 :LS = 15 .CD=WR:FAST 

= 1 
1020 QOSUB 350 : (MSUB 490 : GOSUB 610 
1030 GOSUB 360 : GOSUB 490 : GOSUB 610 IF PEEK 

(TRK) = LT THEN 1050 
ie40TK=PEEK(TRK) ;ST = PEEK (SCT) ; GOTO 1020 
1050 HOME : PRINT "COPY' DONE" : END 
10010 PRINT CHR$ (4); "BLOAD' LOGO. RWTS" _, 

-S 
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another look at... 



Apple Logo II 



by Bill Fogg 



Apple Computer 



Rcquircmcitts: 

64K Apple 1[ Plus, /h or //c 

(LOGO II requires 128K //e or //g) 
A ProDOS disi< with BASIC. SYSTEM 
Copy program that can skip tracks 
A blank disk or iwo 

Back in COMPUTIST No. 27. page 8. was 
Tim Betkmann's suflkey For Apple LOGO II. 
With great anticipation [ tried it. Howevei', my 
version would iiol tiudge. [I would not be 
copied , The following softkey is for use on the 
ProDOS 1,1,1 version of LOGO n. If Tim's 
.softkey didn't work for you, try thi.s one. 

Apple LOGO n 

Apple LOGO II is an outstanding 
programming language. It is very user 
interactive and is an excellent vehicle to teach 
programming and the use of computers to 
children. However, it is copy protected. So if 
good old Muiphy (you know, the one who said 
wliaiever can go wrong, will) happens to visit 
ihc kids one day, there goes your program disk. 
Fear not, the solution is easy. 

The Controller 

The controller for Super lOB 1 ,5 listed here 
is nearly the same as the one that Tim 
Beckmaifupres-enled, Liue.'j 1030 and lf)70call 
the "R/W a range quickly" routine in Super 
lOB to read or write one track at a lime. In lines 

1050 and 1080 if the next track to be read in 
or written to is track 1 then LT will equal 1 and 

i'K (the track to be read or written to on the 
next pass) will become 2, ihu."! bypassing track 
one. It would be necessary to write a new 
RWTS to read in track one to use Super TOB 
to copy that. But why bother';' Apple gave us 
a program to do that for us right on the .\pple 
LOGO U Program Disk. 



The Protection 

The ProDOS version of Apple LOGO II has 
two and one half bytes (FP C FC) written 
between the data header (D5 AA AD) and the 
actual start of data on track one. The rest of 
the disk is standard ProDOS, The first eight 
blocks of data for the file "LOGO 1' ' arc located 
on track one, with the rest of the file filling 
tracks two through seven. The key block for 
"LOGOl " is the very First block of the file and 
is located on block seven. Normally the key 
block is the second block of a file widi ProDOS 
filling the first block with data before deciding 
that the file needs a key-block. 

■fhc file "LOGO.SYSTtiM"' is rhc first file 
executed when the disk boots after loading 
ProDOS. LOUO.SYSTliM is merely a loader 
for the real LOGO Operating System, LOGO 1 . 
LOGO.SYSTEM reads in the file LOGOl and 
jumps to the beginning of it. By slightly 
modifying LOGO.SYSTEM wc can persuade 
it to load LOGO] for us so we can save it to 
a normal disk. 

Step by Step 

1) First you must copy the Apple LOGO 11 
Program disk with a copier that will ignore bad 
sectors or one that can be used to copy specified 
tracks Copy track zero and tracks $02- $22 

{2-M decimal). You may use the coniroller 
below with Super tOB vl.5, 

2) Bool a ProDOS disk containitig 
BASIC.SYSTEM, 

3) Put the "Apple LOGO 11 Program disk" in 
drive 1, 

4) Set the ProDOS prefix to "LOGO". 
PREFIX /LOGO 

5) Bioad LOGO.SYSTEM. The address and 
type parameters are necessary for loading 
"SYS" type files. 

BLOAD 

LO(;O..SY.STEM , A$2fl»» J.SY.S 

6) Enter the monitor. 
CALL-151 

7) Patch LOGO SYSTEM so that instead of 
jumping to LOGOl , after it is loaded, it jumps 



into the monitor, A checksum must also be 
defeated. 

2ie3:A9 m 
2154;4C 59 FF 

S) Start the loader, (LOGO.SYSTEM 
modified), to load LOGOl . 

20000 

9) After your friendly Apple beeps and you see 
the monitor prompt In the bottom left comer 
of your screen and your drive stops. LOO 01 
is loaded in memory ftom $2(M0 to $8FFF. 
Reconnect ProDOS. (The JMP SFF59 
disconnects ProDOS), 

BKmG 

10) Put the copied disk in drive 1 , UNLOCK, 
BSAVE and LOCK LOGOl. ProDOS takes 
care of the length but with "SYS'' type files 
you must specify the address and file type 
(TSYS), 

UNLOCK LOGOl 

BSAVE LOGOl, A$2e»8,TSYS 

LOCK LOGOl 

!1) UnliKk LOGO.SYSTEM on the copy disk. 

UNLOCK LOGO.SYSTEM 

12) Load and mtxlify LOGO, SYSTEM so that 
it will load and execute the unprotected version 
of LOGOl. 

BLOAD 

L(K;(>..SYSTEM,A$2fl»0,TSYS 
CALL -151 
2103:A9 00 
22ES:A9 80 

13) Resavc LOGO.SYSTEM to the disk and 
lock it. Again, ProDOS takes care of die length, 

BSAVE 

LOGO.SYSTEM, A$200e,TSYS 

LOCK LOGO.SYSTEM 

14) Make a COPY A copy of this disk for 
Murphy's Law, and you're finished! 

controller 

1000 REM LOGON CONTROLLER 

1010 TK = .ST = 15 .LS= 15 .FA3T=I .CD = WR 

1020 Ti = TK : GOSUB 490 

1030LT = TK + 1 . GDSUB6ie 

1940 IF PEEK (BUR) - MB THEN 10SS 

1050TK = TKll + (LT=n : IF TK< 35 THEN 1030 

1050 TK = Tl : GOSUB 490 

1070LT = TK + 1 ,. GOSUB 610 

10S0TK = TK+1+(LT = 1 ) : IF PEEK (BUF ) < MB 

AND TK< 35 THEN 1070 
1090 IFTK<35THEN1@20 
1100 HOMt ; PRINl "DONE" H I TW' COPY" : END 

controller checksums 



- S356B 1050 - SA320 

1010 - SC83F 1070 - S7D7D 

1020 - S1B57 1080 - SCD62 

1030 - S5F7E 1090 - J4C37 

1040 - i3700 1100 - JE063 
1050 - S26B6 
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Fishies 



by Kevin Sartorelli 



Fishies 1.0 
Harper & Row 



Requirements: 

Super lOB 1.2 

DOS 3.3 slave disk 

Method to reset into the monitor 

Fishies is an interesting way ol' huving mi 
aquarium when you don'i have an aquarium. 
The program allows your computer sereen lu 
be the front of an aquarium complete with Fish. 
a suhmarlne, a mermaid and a frogman, Tlie 
introduction is very long and I wanted to bypass 
it, but unfortunately the disk is protected. The 
protection scheme relies on altered DOS marks 
and having the main program on a very non- 
standard track tirack 3), Below is a method of 
deprotccting this disk. It stans out by getting 
the main program into memory and capturing 
it, then it uses an lOR controller to copy the 
rest of ihe disk, 

1} Boot the Fishies disk and when the 
introduction starts break into the monitor. 

2) Modify the loader to exit to tlie monitoi when 
finished, 

BCE5:4C 59 FF 

3) Execute the louder to iQttd in the prptectpd 
irack (track 3). 

BC:56G 

To check that it worked, the following code 
should be at EB15: 

B15- A9 00 LDA Dm 
E17- SD 11 05 STA S0BI1 
BIA- 8D 12 SB STA S0B12 

4) Move the JUM loaded code to a safe plaee. 



5) Capture the protected RWTS for Super lOB, 
28e«<B886.BFFFM 

6) Boot a slave disk. 

7) Save the RWTS and the code from track 3 
to disk. 

nSAVE RWTS. FISHIES, A$28M.U8e» 
BSAVE TRACK3 CODE,A$18»0,L$Ce» 

8) Use the Super lOB 1 .2 controller at the end 
of this anicle to eopy the disk. You may also 
liuve to delete some of the following lines from 
the lOB program as the controller Is a long one 
and you may run out of room (the following 
are all RKMs): Lines 10, 20, 30, 40, 50, 70, 
90. 120. Lis. 150. 170, iy0. 200. 220, 230, 
240. 250. 260. 270. 2Rfl, 3fl0, 31l?l. 350. 370", 
420, 440, 460. 480. .S40, 10000, and 18130. 

The controller performs a number of sector 
edits 10 change their DOS to read ii normal disk 
and tell the program about the new track 3. 

9) When it has finished copying the di.sk. loud 
the previously saved TRACKS COUH back into 

memory. 

BLOAD TRACK3 CODE 

lU) Enter the.nionitor and type in the following 
code, 

CALL -151 

Sm:X9 m A9 18 28 D9 83 BO 

nm-.m ee 21 m ce id m le 

81B:EF m 2» 2D FF 4C .i9 FF 
818:01 60 01 m 03 m 2A 08 

S2ii:m lamm iti m m 60 

828:01 80 01 EF D8 00 

11) hisert your copy of FISHIES and ty pe 8fWG 
to write the ctxlc onto track 3, 

To .ivoid the long introduction try the 
following on your copy. Read track $12, .sector 
1 (their VTOC) and write this sector lo track 
$11, sector (which is unused by FISHIES). 
This will allow you to catalog the FISHIES 
di sk. B oot a noniial DOS 3,3 disk and LOAD 
qOS WERTY. Don't try to list this program 
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or it will destroy itself! I'ype 250 PRINT then 
ft ONERR GOTO_25», This will Irap uriy 
error, including j'._^iCI , and run the next 
program. Now type the foltnwing; 

UNLOCK orWl WERTY 
SAVE QOy] WERTY 
LOCK QES WERTY 

Now wt; need to modify the amount of screen 
that gets cleared to insure the whole screen is 
cleared as wc don't know what will be on it 
when the program is interrupted. To do this tvpe 
LOAD CONTINUE^V] , 

Type in the following lines, 

60ttCOLOR=4 FORY = 2T073 : HPLOT20 .VTO240 

.V . NEXTY 
65 FOR y= 74 TO 197 : HPLOT , YTO 235 , V ■ NEXT V 

Now type the following: 

LNLOCK CONTINUEES 
SAVE CONTINUE OS 
LOCK CONTINUEISS 

Now when you wish to leave the in trodu ction 
and enter FISHIES proper just type a. ILJCI and 
the introduction will stop and the main program 
will load. 

controller 



ITK = ;ST = :LT^35 :CD = WR 
leiGTlrTK ■ GOSUB490 ■ POKE 47397 .24 : POKE 

47398 ,95 : POKF 47496 .24 . POKE 47497 ,95 
1020 GOSUB 430 : GOSUB 100 ;ST=S1 + 1 : !FST< 

10 THEN 1020 ; REM RtAD 'NORMAL' SECTORS 
1030 POKE 47397 . IBS : POKE 4739S , 140 POKE 

47496 ,158 : POKE 47497 ,208 
1040 FOR I =11623 TO 11651 , READ A , POKE I ,A 

; NEXT ■ REM PATCH CODE 
1050 A = 234 FOR I = 11652 TO 1174S : POKE I ,A 

. NEXT , POKE 11/47 .169 : POKE 11748 .154 
1060 POKE 10748 ,173 : POKE 11014 .78 . POKE 

11178,170: POKE 11940, 78: POKE 12109 ,76 

; POKE 12110 ,7 , POKE 12111 ,191 : POKE 

12243 ,70 
1070 POKE 12291 .3 , POKE 12292 .76 : POKE 1J293 

,72 ; POKE 12294 ,190 : POKE 12295 .134 : 

POKE 12295 ,72 ;A-70 
1080 POKE 12310 ,A ■ POKE 12345 ,A . POKE 12373 

,A : POKE 12375 ,A . POKE 12379 ,A : TOKE 



12445 ,A : POKE 12451 ,A : POKE 12453 .A 

1090 FOR I =10806 TO 10817 : READ A ' POKF I ,A 
: NEXT : FOR I ^ 10898 TO 10909 : READ A . POKE 
I ,A:NEXT: FOR I = 11113 TO 11156 , READ 
A: POKE I ,A : NEXT 

1100 GOSUB 360 : ON ERR GOTO 550 

1110 GOSUB 430 : fiOSUB 100 :ST = ST4l , IFST-: 
DOS THEN 1110 

1120 IF BF THEN 1150 

1130ST = 0-TK = TK.l. |FTK = 3 THENTK = TK + 
1 GOTO 1110 

1140 IFTK<:LTTHEfJ1110 

1150 GOSUB 490 TK = T1 :ST = : GOSUB 360 

1160 GOSUB 430 : GOSUB 100 :ST = ST+1 IFST<: 
DOS THEN 1160 

1170ST = : IFTK = 2THEN fK = TK+ 1 

1180TK = TK + i : IF BF = SAND TK < LT THEN 1160 

n90IFTK^LTTHENTi = TK:COSUB490:GOTO1100 

1200 HOME : PR I N I "EVERVTH I NG° OK . " DO' REST' 
OF'SOFTKEY," : END 

10030 PRINT CHfiS (4 ) "BLOADRtVTS, FISHIES 
.AI1900" 

62010 DATA 141 ,38 ,3 .169 ,11 ,141 .39 ,3 .169 
,8 ,141 ,43 ,3 ,169 ,0 ,141 .42 ,3 ,32 ,56 
,3 .238 ,43 ,3 .206 .39 ,3 ,15 ,245 

62020 DATA208 ,10 .234 .189 ,140 ,192 ,15 .251 
,201 ,170,240,92 ,208.174 .234 ,189 140 
,192 .16 ,251 ,201 .170 ,208 ,164 

62030 DATA 32 ,168 .166 ,173 ,219 .191 ,16 .5 
.169 ,2.32 ,141 ,177.159.0 ,141 ,219.191 
.141 .218,191 ,173,186,179 ,76,239,157 
,169 ,0 ,141 ,237 ,157 ,141 ,238 ,157 ,141 
,217 ,191 ,32 ,U8 ,186 ,76 ,Si .168 



controller 


t:hecksums 


1000 - $2129 


1130 - ?B037 


1010 - S56E7 


1140 - $D0BS 


1020 ' JF29B 


1150 - SC06B 


1030 - »ACf 


1160 - S9C5D 


1040 $62D5 


11/0 - S84A2 


1060 - SD205 


1180 - I59CF 


1069 - SF635 


1190 - $A265 


1070 - S3C34 


1200 $0223 


1080 - $8075 


10030 - $C12A 


1090 - S2EFF 


62010 - $5227 


1100 - $E020 


62020 - $9066 


1110 - mzi 


62030 - 5AAE9 , 


1120 - $0411 
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Infocom 
Revealed 



By George and John Bigelow 



[ntocom text adventures are fasL-iiiatiiig and 
often very difficult games. They are filled with 
situations where not tinly is the solution to a 
particniarsituatii.m not obvious, but may require 
having made some erueial deeision earliet in 
the game. In sneh situations the player ean 
benefit immensely from elues. Infoeoni does 
pmvide ;i ser of dues, but you are required to 
purehase them separately troin liie game. This 
is not particularly helpful when one is deep into 
the game on a Friday nightl hi addition, it 
somehow doesn't seem right to pay for the 
game, then have to pay additionally fur help 
(however, Infoeom doesn't seem to mindt). 

For many text adventures, there is a faster 
and cheaper way to gel clue.'; when ."ituck: you 
merely fire up a sector reader such as Copy || 
Plus, and snoop through the di.sk for any text 
eontalned within the game'."* files. For example, 
the files of the Ultima series and Tran,sylvania 
ean he read this way. 

Since these files are generally organi7ed as 
a .set of disconnected sentences and sentence 
fragnients, they do not give the game away or 
tell one what to do in a panieular situation. I'hey 
do, however, provide clues as to what objects. 
actions, and sittiations are important in the 
game. Often this is enough to get you moving 
again when siuek in a tough situation. 

Unfortunately, this technique docs not work 
with Infocom I Those who have tried it have 
I'ound very little (if any) in the way ot text on 
any Infocom disk. Where do all the words for 
liie game come from? The answer is that 
Infocom uses a two-for-thrcc coding technique 
in order to store its text more efficienity. 



The essential idea is this: a byte of 
information contains 256 different possibilities. 
However, text needs only a small part of these 

possibilities, say 26 letters plus a few others. 
[t is possible, therefore, to reeixle a string of 
characters so as to make it fit into less bytes. 
In Infocom 's case, three characters iirc recoded 
so as 10 lit within two tsytes. 

Figuring Out (nfocom's Approach 

How docs Infocom do this? The following 
steps parallel how we went about discovering 
this. You may be interested in trying them out 
on your own. Initial work was done with the 
Macintosh version of Hitchhiker s Guide to the 
Galaxy (Hiichhiker). Later work was done on 
the Apple version. 

1} We figured that Infocom wasn't going to do 
anything tricky. After all, the purpose of coding 
the text was to conserve space, not to hide it 
frtmi players. We started with this idea: a byte 
is 8 bits of mformation. Two bytes together 
make 16 hits. If those bits were divided into 
three parts, it's possible to make three five-bit 
nibbles, with one bit left over. 

A live bit nibble can represent iwo-to the- 
fifth, or 32 possibilities. This .should be enough 
pt>asibilities for one byte of text (assuming one 
doesn't u,se numerals), 

2) We wrote a program which reads files and 
prints them out in binary format (the final 
evolution of this program will he described 
later). We found sections, none very long, 
where every other byte began wilh "'0". We 
figured thai these might be the start of two byte 
sequences, in which byte pairs would translate 
into three characters. 

3) We instrtieted the program to look lor 
beginning zeroes, to combine byte pairs into 16 
bit Strings, and to divide the string into m initial 



iero bit. plu.s tliiee five -bit strings. The program 
then tran.^lated each of these strings into a 
number (ranging, of course, between ft and 31 ). 

4) We then tried the logical thing, assigning an 
"A" to 0, "B ' to 1, and so forth The resnli 
was garbage! We then did a frequency eoiint. 
We noticed, with quickening pulse, thai if we 
assigned the alphabet starting with the si\tb 
number rather than the first, that the frequencies 
were what we would expect of siaiisiicu! 
distribulionsof letters; e.g. lots of vowels, not 
SO many Q's, X's and so forth. We then 
instructed the program to make these 
assignments. 

5) Bingol The resulting translation results in 
strings of sen.sc, separated by strings of 
garbage. In studying what wc found, we figured 
out that some of that garbage is coded word.-i. 
For e;(ample. ■"<?" is "and", "=F" is "but", 
and ">U" is "between". We surmise that 
Infocom reduces ihe si/.c of its text in two 
passes. In the first pass, the entiie text is 
searched for commonly used string .segments 
which are translated into shorter char.ieier 
sequences. In the second pass, every three 
characters is translated into two bytes. We have 
not heKn able to figure out how to tell whicli 
byte is the start uf a two byte sequence. 
Printouts show that the program will be oii track 
for a while, ihen lapse into garbage, then make 
sense again. 

Our hunch is that there i.s an address table 
somewhere that tells where to stan sequences. 
Lacking knowledge of that table, our approach 
is to decode each block of bytes twice, starting 
first with the first byte in the sequence, then 
decoding again starling with the second byte, 
One of the two is accurate fur every part of the 
code, 
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A Program to Decode Infoeom Text 

In [hiK section, we describe n program, 
"Intbcom Te.tl Reader", It is an Applesoft 
BASIC program (plus a little macliine language 
to speed things up a bit) developed on an Apple 
][ Plus which will read and decode am text on 
an Infocom disk {wiih s«mc reservations about 
the very latest releases, we hear that they have 
changed somellung), and thereby give you a 
deeper understanding of the Infocom game. It 
starts by reading one sector from the disk into 
memory, h then calls a machine ianguugt; 
subroutine which combines each pair of 
hexadecimal number.'; into a sixteen digit binary 
number, divides that number into three binary 
numbers (ignoring the MSB) and converts ihein 
into letters and symbols. It Irarslaies and prims 
the sector twice, starting with even byte pairs, 
then shifting one and repeating the process. 

r- Keying it In 

Type in the Applesoft portion of Infocom 
Text Reader and .save it with: 

SAVE INFOCOM TEXT READER 

Next, using the instructions on the inside 
front cover of this magazine, key in the 
bexdump and save it on the same disk with: 

BSAVE (>BJ.READER,AS3efl,L$43 

You're now ready to do some serious 
snooping! 

Using Infocom Text Reader 

Enter the program "Infocom Code Reader" 
and save it to your disk. When the program is 
run you will be asked to select a track. Remove 
your disk and put in the Infocom disk you wish 
to research. Select a track, then sector. The 
heading called DOS is automatic and will take 
care Ol itself, A few things that are not obvious 
that should be mentioned: type in Q whenever 
TRACK is displayed to quh the program 
(normal DOS is also reinstated). Typing + or 
-. wilt select the next track or sector and next 
lower tract; or sector respectively. Just typing 
return will select the same track or sector. One 
thing to keep in mind, the next sector is not the 
numerically next sector! Infocom sectors skip 
around some, and + and - take thai into 
account. For those who care, the sector order is: 

e. 13. 11, 9. 7. 5, 3, 1, r 

14, 12, 19, 8, (J, 4, 2, 15 

To print the screen on paper scl(;ct "Y" 
when asked if you want lo print the screen. You 
will ihen be asked if you want single or double 
spacing. Turn on your printer and select either 
single or double spacing and away you go! 

Whiy Two Passes? 

Say wc have the numbers I. 2, 3, 4, 5 to 
make pairs of any two numbers tiial are noil 
to each other. Ihe possibilities are 1-2, 3-4, and 
skip 5 or 2-.1. 1-5 and skip K Either of these 
combinations of hexadecimal bytes as read off 
an Infocom disk may have meaningful 
information in them, Infocom seems to have no 
set way (by sector, anyway) to combine the hex 



bytes. So to retrieve as much information as 
possible, we go back and make Pass 2, skipping 
the first and last hex numbers (we may lose up 
to four letters that way. but wc can't think of 
a belter way without getting too complicated). 
The screen will show 10 tines (pass I) then 10 
more lines (pass 2), Soine where in both passes 
is all the text you are looking for! 

Abbreviations 

The latest disk we have is Hitchhiker, and 
the program works for it and all previous disks 
(such as the Zorks, Planetfall, Enchanter and 
Sorce,rer), Each disk has a list of all acceptable 
words that can be typed in (of course only out 
to six letters). On most of these disks the list 
may be found on track 7, and on some track 
6, These are seveial sectors long, so once you 
have found it use <RETURN> for track and 
+ for sector. 

The words are evenly divided between Pass 
1 and Pass 2, We suggest printing the screens 
and using HiLiters. 

The wurds that the program prints (THIiRF 
IS A VIOLENT EXPLOSION, and so forth) 
are scattered all around, generally from track 
4 on. In reading these you get a sense of 
frequent garbage. For instance, in Hitchhiker 
you might see this: 

?WHEN ; = JoCOME : <F<BSENSES ;<? SOLVE ; <RPUZ 
ZLESP 

This brings us to abbreviations! Infocom has 
a list of short forms of words, to fhrthet save 
space. For instance, "=J" means "will". 
"o" is "yon". The question mark capitalizes 
the following letter, and the "@P" is a question 
mark. The translated statement will lead 
"When will you come to your senses and solve 
the pu;;^le?", To find the li.si of abbreviations 
look on track 3 sectors 0.13. and on some 1 1 
(the 13 and 1 1 are automatically selected from 
sector by using -I- when selecting the next 
sector). 

But just a list of the words is no help, you 
have to assign the abbreviation to the word. An 
abbreviation is always tw'o symbols long and 
start with one of these three characters: "<, =, 

The second character of an abbreviation is 
(in order); ";< = >?@ABC ... Z". Therefore, 
to get a list of the abbreviations and the words 
lljey ure associated with, do this: print out track 
3 sectors and 13 double spaced. You should 
see a lot of semicolons, then a list of words. 
Starting with the first word write above it "<;" 
and above the second "<<" and so forth (< = , 
<>, «§>, <A and .so on). After the word 
designated by "<Z" start with " = ;" through 
"=Z", then ">;" through ">Z". In some 
games the list is quite short and you will not 
use all the symbols, 

[n Hitchhiker "<;" is "the", "<<" is a 
comma, "< = " is "You" and "<'.''" is "and". 
These are different on every disk, so this must 
be done for every title you try. Sorry about that! 

Some other things you must know: ";" is 
a space, "@M" is a period, "@0" is an 
exclamation point, "@P" is question mark. 



"@S" is an apostrophe, "@T" is a quote 
mark, "@W" is a dash. "@X" is a colon, 
"@Y" is a left parenthesis and "@Z" is a right 
parenthesis. These are all we liave figured out, 
the rest of the letters must mean something , 
perhaps numbers, 

Zork I! is different in that the = capitalizes 
the next letter and ">S" is an apostrophe and 
there are probably more differences. Most of 
our investigations have been in Hitchhiker. 

Final Notes 

This program will not answer all your 
questions, and indeed may i-.-jise several , but the 
list of allowable words alone is worth a lot if 
you arc stuck. Here's something to mull over: 
in Hitchhiker on track 18 sector J0 Prosser has 
a game manual. And we'll let you take it from 
there! 

Infocom Text Reader 

10 REM * * 

20 REM * f INFOCOM TEXT READER =:< 
30 REM w * 

40REi;fl '-BY: * 

50 REM * GEORGE BldELOff * 
60 REM * E JOHN Bl(5EL0W * 
70 REM 'X * 

313 REM * ENHANCED BV: * 
913 fieM * RAY DARRAh * 

100 REM * =;= 

110 RFM 

120 TEXT : HOME 

130 IF PEEK (768 ) <> 169 THEN PRINT CHR$ (4 ) 

"BLOAD'OBJ.READER" 
140REMSE1 UP VARIABLES 
150 COMDOS = 188 :STDDOS = 173 : POKE 47556 

■ STODOS ,DOSS= "STANDARD" 
160 REM MAKE SELECTIONS 
170 HOME : HTAB 10 : PRINT "INFOCOM" TEXT' 

READER" 
130 VIAE 2 . HTAB 9 . PRINT T 
190 VTAB 2 ; HTAB 3 : INPUT "TRACK: " ;T$ : IF TJ 

<> "Q" ANOTSo "" ANDT5< > ■' + '■ AND TI< 

>"-"THENT = VAL {TJ ) 
200 I F T$ = "0" THEN POKE 47356 . STODOS : HOME : 

END 
210 I F T < OR T > 34 THEN T = S GOTO 170 
220 QOSUB 420 

230 VTAB 2 , HTAB 21 : PRINI S 
240 VTAB 2 : HTAB 14 : INPUT "SECTOR; " ;SS : IF 

S$ <> •'+" AND SS <> "-" AND SS <> "" THEN 

S = VAL(S$) 
250 IFS<0ORS>15THENVIAB2 : HTAB 21 : PRINT 

'"•"'■ . GOTO 240 
260 GOSUB 500 

270 VTAB 2 : HTAB 26 : PRINT "DOS " 'DOSS 
230 REM CALL RffTS 
290 POKE 47083 ,0 ; POKE 47084 T : POKE 47085 ,S 

: POKE 47088 : POKE 47089 ,150 ■ POKE 

47092 ,1 
300 CALL 768 j 

310 REM AUTO DOS SELECTION 
320 ERR = PEEK {47093 ) : I F ERR <> 64 THEN 380 
330 DOS = PEEK (47356) 
340 IF DOS = STDDOS THEN POKE 473 5G , COMDOS ■ 

VTAB 2 , H lAB 30 : DOSS = " I NFOCOM " " : PR I NT 

DOS! : GOTO 360 
350POKE47356 .STDDOS , VTAB2 : HTAB 30 :DOS$ 

= "STANDARD" : PRINI DOSS 
360 CALL 768 
370 REM PRINT DECODED SECTOR 
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3B0POKE776 CALL 775 : PRINT . POKE 776 ,1 

.CALL 77.5 
39B POKE - 16368- ,0 : PRINT . VTAB 24 PRINT 

■'PR I NT" THIS' PAGE? '(Y,N);" ; :WM. IF 

AI = "Y" THEN 610 
460 GOTO 170 
410 REM PRINT TRACK 
420 IFTS = "" THEN 470 
"W I F TS = "+" THENT - T U ; GOTO 450' 
440 IFTJr "-" THEN T = T- 1 
450 IFT<01HENT = 34 



460 IFT>34THENT:=0 
470\/TAB2 : IITAB 9 ; PRINT T; '■" " 
480 RETURN 
490 REM PRINT SECTOR 

500 IFSS = IHEN5S0 

510 irS$ = ■'+"THENS = St 13 

520 I F S = 2S THEN S = : GOTO 5S0 

530 IFS> 15THENS = S- 15 

640 IFS5 = "+" THEN 580 

550 IFSS- '■-■' THbNS=:S-i3^ ■ 

560 IF S = - 13 THEN S = 15 : GOTO 580 



Infocoin Text Reader Source Code 



inf ocoiii Text Reader Machine Routines 
By Ray Darrafi 



.OR S300 
TF OBJ READER 



96M- 
FF 
FE- 
FD- 



BUFFFR 
CHAR I 
CHAR2 
GHAR3 



FDF0- GOUT 

0300- A9 B7 
0392 A0 EB 
0304. 4C 05 03 



EQ S9.6@0 

EQ SFF 
.EO SFE 
.EQ SFO 
.E(J JFOF0 



0307, 


A0 00 


LDV 


9309' 


B9 00 % GETl 


LDA 


030C. 


29 7F 


AND 


030E 


4A 


U.SR 


030F- 


4A 


LSR- 


0310: 


35 FF 


STA 


0312 


B9 00 96 


LDA 


0315; 


29 03 


AND 


0317: 


0A 


ASL 


0318: 


0A 


ASL 


0319: 


0A 


ASL 


031A 


85 FE 


STA 


031C: 


CB 


I NY 


0310. 


F0 23 


BEQ 


031F; 


B9 00 96 


LDA 


0322' 


4A 


LSR 


0323. 


4A 


LSfi 


0324; 


4A 


LSR 


0325. 


4A 


LSR 


0326: 


4A 


LSR 


0327 


05 FE 


ORA 


0329 


85 FE 


STA 


033B 


B9 00 96 


LDA 


032E 


29 IF 


AND 


0330 


85 FD 


STA 



FIRST CHARACTER AT $FF 
SECOND CHARACTER AT SFE 
FINAL CHARACTER AT SFD 
PRINT A BYTE 

LDA *$B7 SET UP FOR RWTS CALL 

LDV SSEB- 

JMP $3D9 CALL RPS AND RETURN 



m FIRST TIME. 1 NEXT TIME 

BUFFER. V 

#}7F STRIP OFF MSB 



CHARl GOT FIRST CHAR 

BUFFER, Y 

oiJ ONLY BITS AND 1 



CHAR2 GOT BITS 3 AND 4 

RTSl IF DONE, RETURN WITHOUT PRINIING 
BUFFER. V 



CHAR2 MIX BITS 0-2 WITH 3 AND 4 

CHAR2 GOT SECOND CHAR 

BUFFER, y 

«ilF BITS THROUGH 4 PLEASE 

CHAR3 GOT THIRD CHAR 



0332 

0334 
0336 
0337 
0339 
033C 
033D 
033F 
0340 
0342 



A2 02 
B5 FD 
18 

69 BB 
20 F0 
CA 

10 F5 
C8 

D0 C7 
60 



PRINTl 



FD 



LDX «2 

LOA CHAR3.X 

CLC 

ADC #187 
JSR COUT 
DEX 

BPL PRINTl 
I NY 
BNE GETl 



PRINT THREE CHARACTERS 
GET A CHARACTER 

ADO 187 TO GET ASCII 
PRINT IT 



570 IFS<0TH£NS = S + 15 

580 VTAB 2 HTAB 21 . PRINTS. '" " 

590 RETURN 

G00REMPRINT PAGE 

610 VTAB 24 ■ HTAB 7 PRINT "DOUBLE" SPACE'" 

(Y/N) ■' , . GET AS 
620 PRS l' 

630 FOR Y = 1 TO 22 ' ■ J 
640FORX = !TO40 
650 VTAB Y . HTAB X 
650XY^SCRN.(X-1 ,2 * (Y- I ) ) + 16 * S&RNC 

X - 1 , 2 * (Y - 1 ) t 1 ) 
S70 PRINT CHRS {XY ) : 
680 NEXT . VTABl .PRINT 
690 IFA5 = "V'THENPRINT i 

700 NEXT 

710 VTABl : PRINT 
720 PRS 
730 VTAB 24 ; HTAB 1 . PRINT "FRESS^ A^ KEY" TO" 

.CONTINUE->" ; ,;.^ET AS 
740 SOTO 170 ■■ 



Hexdump 



0300; 


A9 B7 A0 E8 4C D9 03 AS 


JE152 


030B; 


00 B5 00 96 23 7F 4A 4A 


iiC10 


0310; 


85 FF B9 00 96 29 03 0A 


SAE19 


0313: 


0A 0A 85 FE C8 F0 23 B9 


S9F39 


0320- 


00 9G 4A 4A 4A 4A 4A 05 


saoBS 


0323: 


FE 85 FE B9 00 95 29 IF 


SE073 


0330: 


85 FD A2 02 B5 FD 18 69 


$4A04 


033B; 


BB 20 F0 FD CA 10 F5 C8 


$4F8A 


0340; 


D0 C7 60 


$9753 



checksums 



RTSl RTS 



10 


- $BA0D 


380 


- SB7AC 


20 


- J9ei3 


390 


- S3527 


30 


- J4D3B 


400 


- $8F61 


40 


- iAD92 


410 


- S45O0 


50 


- SC899 


420 


- SA35F 


m 


- SFF65 


430 


- %zm 


70 


- $A3BF 


440 


SA53D 


80 


- $A900 


450 


- 14828 


90 


- $9240 


460 


$4 IBB 


100 


- $CB63 


470 


- S05A2 


110 


- SBD13 


480 


- S31SC 


120 


- S962A 


490 


- SDCF4 


130 


- SI 403 


500 


- SD55D 


140 


- SBD65 


510 


- I19D0 


150 


- SEAS 2 


550 


- I1D67 


160 


- jaSAF 


530 


- 10587 


170 


- S7F32 


b40 


- S7811 


180 


- S8t60 


550 


- $B96E 


190 


- SI29A 


560 


- I26D3 


200 


- $64F3 


570 


- $1E3F 


210 


- $-5848 


580 


- $3541 


220 


- I90BA 


590 


- $6182 


230 


- $EA43 


500 


- i55A6 


240 


- SC0F8 


610 


- S67A4 


250 


- SF7aB 


620 


- $4D2B 


260 


- SA3CD 


630 


- ID37D 


270 


- $33DC 


540 


- S209A 


280 


- tE4A3 


550 


- $6A90 


290 


- $D49B 


660 


- SSDBb 


300 


- S8DE4 


670 


- SDDA2 


310 


- S740E 


580 


- $41DD 


320 


- S732D 


699 


- $57A9 


330 


- SD77F 


700 


- $C23C 


340 


- SDD0F 


710 


- I386E 


350 


- $75C8 


720 


- }09C1 


360 


S38AD 


730 


- $E920 


370 


- M187 


740 


- SBfllB 
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By Wes Felty 



COMPUTIST has had sonic very good 
articies cm modilying ROMs In (he past, 
especially COMPUTIST No. 19. Ihe method 
of using swiichable dual ROMs presented in that 
issue climmaicd any concerns I had about 
incompatibilities between software and 
modified ROMs. With the switchsibic ROM 
system, you can ^Iway.'; switch on a normal 
ROM if any problem shows up with your 
modified one. 

While COMPUTIST 's articles had verv- good 
patches, if you don't know assembly latiguage, 
you were left in the cbrk as to why what was 
placed where. In this article, I intend to expand 

on some of the ide;tfi to help yon develop your 
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own modified ROMs further, tlx and improve 
some of the ][ Plus routine,^, givt some 
informuliijii about the Don Lancaster patch 
(explained later) tor the /7c atid //c c'oniputcrs. 
and offi-'r some improvements on the I ^incaster 
patch . 

Let's Start at the Beginning 

First of all, lets look at EPKOMs in general. 
The 2716 and 2752 EPROMs are not directly 
compatiiile with the Apple ]| Pius but the 2764 
and 27128 EPROMS are aimpntibk with the 
Apple lie and lie's. These EPROMs can be 
direaty substituted with no hardware 
modification needed. 

However, you should be careful when buying 
EPROM's. I recently bought a number of 
2732 's that were rated at 350 nanoset-onds (ns) 
and none of them would work in my Apple ]\ 
PI UK, 1 wt;ut 10 another plate and bought ones 
rated at 25(1 ns and they worked great. Every 
batch that 1 buy is theaper than the last, but I've 
learned to watch the speed rating and to not buy 
too many of a batch until 1 have checked them 
0\it. 

Number Crunching 

What does the "16" in 2716 mean anyway? 
Doesn'l it mean 16K? Yes and no. A 2756 
EPROM holds 2K bytes. So, why don't the 
numbers agree? Because every byte is made up 
of 8 bits, the 2716 holds 16k bits wtiich 
translates into 2K bytes (16K / 8 = 2K). 

If this is true, then, wiiy does the data to fill 
a 2716 take up 10 disk sectors and the data to 
fill a 27^2 take up 18 disk sectors instead of 
8 and 16 sectors respectively? Remember that 
for a DOS 3.3 llle, one extra sector is required 
for a Irack/seetor list. Additionally, binary files 
are stored on disk with the address and length 
of the file preceeding the actual data, so these 
extra four bytes push the data over ontt) an extra 
sector that holds just four bytes. Therefore the 
full binary files each require two additional 
sectors as overhead. 

Using a Language Card for Testing 

There is a much easier way to test your 
routines as yon develop them than burning them 
into an EPROM. teslinj; them, eiasing theiu and 
reburning them which can be particularly 
annoying if you don't have an EPROM 
programmer. 

The Language or RAM card (they are one 
and the same) can be used for testing purposes 
since It occupies the same memory positions as 
ROM. Tlie RAM card, which is built into /,'e's 
and .'/c's, caii be batik switched so that a 
machine language program can be loaded into 
RAM al high ROM addresses. For obvious 
reasons, these prtxedures need to be done with 
standard DOS 3,3 and not a version of it that 
is moved to the Language Card. ProDOS can't 
be used, since it (Keupies the Language Card. 

First National Apple Switch Bank 

The idea of bank switching is a very 
important one to understand in order to deal 
with today's hardware and software. Bank 



switching refers to liie fact thai the computer 
can have more than one bank of information 
stored at the same memory addresses but at 
differejit physical locations. 

It is similar to having two or more different 
books on the same shel f of a bookcase. These 
books do nut have ilie same information on the 
same page numbers, but they do liavc identical 
page numbers. You can read information from 
only one book at a time, but you can switch 
from book to book. This is similar to bank 
switching. The computer can be to id to read the 
inforiuatton at location SFDED IVom the mother 
board's ROM. the 1 .anguage card RAM in slot 
0, or a ROM or RAM card in any of the other 
slots. Furthermore, if one of the books is a 
notebook, then you can write to it as well as 
read from h on any given page. You aren't 
allowed, however, to write in the original book. 
ROMs do not have the hardware to be written 
lo. That's why they are called Read Only 
Memory chips. 

Moving Right Along... 

Next, you need to understand the soft 
switches that arc used to switch from one bank 
of information to another. These soft switches 
are special memory locations that act like 
switches that get thrown whenever they are 
accessed. So a PEEK, POKE. LDA. STA. BIT. 
etc. to one of these special memory locations 
essentially "Hips" that switch on and all related 
switches off. If you are familiar with the screen 
soft switches which switch from text to lo-res 
or bi-res screens, then you should pretty well 
understand how the language card st>ft switches. 

In flipping these switches, you need to 
remember that while the RAM curd and ROM 
memoty occuijy essentially the same addresses 
in ihe computer's memory, they cannot both be 
aclive at the same time (just as hi-res page 1 
and hi-res page 2 cannot be active 
simultaneously). Therefore, you must flip the 
soft switches back atrd forth lo read or write 
enable RAM when you want to use it and read 
enable ROM when you need it. 

There are sot't switches for every possible 
combination of reading ROM or reading RAM 
and at the same time being able to write to RAM 
or not. Just because you wish to read from 
RAM doesn't mean that you want to be able 
to write to it, so there is a write protect RAM 
feature to prevent any changes being written 
there. 

The soft switches are arranged as follows: 

Table 1: 

RAM Card Soft Switches (Slot 0) 
For Slot ii: AdSress ^ SC0(n+e)X 

Addr Banl< Read Ifffite RAH Protected? 

$Ce80 1 RAM N/A YES 

K081 1 ROM RAM NO 

IC0BZ 1 ROM N/A YES 

1C083 1 RAM RAH NO 



scsas 


3 


RAM 


N/A 


YES 


5C089 


2 


ROM 


RAM 


NO 


JC0SA 


2 


ROM 


N/A 


YES 


IC08B 


2 


RAM 


RAM 


NO 



By flipping 5C082, you can only read from 
ROM, This is the defauU situation. 

By nipping $C08l . you can read from ROM 
and write to RAM at the same addresses 

By flipping SCW8D. you can read from RAM 
but not be able to write to it. 

One important diffeience tielween the reading 
and writing switches is that the write soft 
switches take two accesses to enable them. 

Can you si^ ttpw how fouied up a computer 
could get if a program that used the RAM Card 
ended without setting the soft swhches 
properly? This is why many programs have a 
■■Quit" option or tell you to reboot the 
computer to run another program. 

■When your Apple ][ Plus "dies" and you 
can't even get control with Reset, it is probably 
up in the .liPR page of RAM trying to run the 
Reset routine that is actually over in the $F8 
bank of ROM. 

Turning off the Language Card cttn be done 
by referencing location SC0H2. location SCPPJ-' 
which is the soft switch to disconnect all 
peripheral cards, or a Reset on //e's and //c's. 

Many programs that use the RAM card copj? 
the JF8 ROM over into the $F8 RA.M st> they 
don't have to bank switch back and forth. Some 
protected software programs simply do not use 
liie normal ROM routines. After loading they 
leave the SF8 RAM switched on at all times 
with their own SFS programs. lust use the 
COMPUTIST modified $F8 ROMs to try to 
Reset out of AppleWrher. Homeword, the 
Flight Simulator, or Skytox and sec how far you 
get. On Reset, die hardware goes to SFFFC for 
the address of the Reset routine to u.se. but on 
][ Plus's, it goes to SFFFC in iWtcJteiw hank 
is awiiched on at the time. 

Experimenting With the Card 

Here are some exercises to get you used to 
soft switch flipping. 

Note: When following these, i^xercises. ihe disk 
drive may unpredictably tuns on and gariiage 
any disk, in the drive. 

a) Boot the DOS 3.3 master so that it loads 
Integer BASIC into the language card and then 

remove the disk. 

h) Drx>p into the Monitor and disassemble the 
code at SEfllM. This is the stan of Applesoft 
BASIC. 

CALL -151 
EOetlL 

c) Now use tabic I to figure out which soft 
switch to flip to read enable the ROM and write 
protect the RAM on the language card. Did you 
come up with $Cfl8W'.' To activate this swhch 
from the Monttt)r, you can type "0080" and 
return. This instructs the Monitor to read the 
contents of that address and therefore tlips the 
switch. Tt7 this now. 

cese 
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d) If you disassemble $EM0 again you should 
find different code there. This is Integer BASIC 
from the Language card, 

EOe0L 

You fan start up either one of these BASICS 
with an RflfiflG from the Monitor. 

e) Can you switch hack from RAM to ROM 
by using table IV To read enable ROM. enter 
■■C082" and return. 

C»82 

T) Now rry writing an SEA to location $E0M. 
EtiM-.EA 

g) Did it wnrk? Disassemble it to check it. 

h) Of cour.se it didn't work. You can't write 
to ROM. So switch back to RAM and try It 
again. 

cflse 
Eomi. 

i) Were you surprised'? Why didn't the "EA" 
write to RAM? It's because logation SC0H0 rcaci 
enables but write protects the RAM card You 
could u-se "C08I " which would allow you to 
write to RAM but you wouldn't see what you 
had done since you would be reading the ROM. 

j) All this brings us to location !fC083. This is 
the one that read and write enables the RAM 
rard. Try the following; 

C»83 
C083 
t:tt»tt:EA 
KMm. 

Finally, you have made p change to the 
language card. Play around with different 
settings and iry to answer to yourself why 
different things happen in different settings. 

k) When you are done playing with this, tutu 
off the coitiputer because you may have a real 
mess inside tlie language card. 

The Preparation 

Here is what we have to do to use the 
language card to test our new ROM routines. 
We will have to hank .-i witch the ROM memory 
off and read and write enable the language card 
RAM. Notice thai this requires us to access the 
soft switch at $C083 twice. 

In more detail, we need to copy the $F8 
ROM into the language card RAM, read and 
write enable the language card RAM and finally 
transfer our new routines into the language card 
RAM card wheie they can be eseeuted. 

Actually Using Ihe RAM Card 

First boot the DOS 3.3 system master or 
some other di.sk that loads Integer BASIC into 
the language card. We won't be using Integer 
BASIC, but this process initial i?:es the Language 
Card for us, II you want an image of the 
autostan SFK ROM in the RAM card then 
instead of loading Integer BASIC, you can use 



the following cotiiniands: 

cmi 

cesi 

F8(IB<F8«e.FFFFM 

The first two cotiiniands write enable the 
language card RAM while still using the $F8 
ROM for ail reads. The next command reads 
every byte in the $F8 ROM and stores them in 
the same address of language card RAM. 

Next, we need to read and write enable the 
RAM card. To do this wc need to flip the soft 
switch $C083 twice. Therefore, enter ihi.s 
simple routine from the Monitor: 

3»e:2C 83 CB 2C 83 Cfl 68 
MOG 

If the RAM card later gets diseunneeted. just 
type "30tKj" from the Monitor or "CALL 
768" from BASIC to reconnect it. 

You can now read, write, modify, and run 
the routines from the language card as if they 
were in ROM. 

Checksums 

One type of diagnosis thai the Apple 
computer can do to itself or programs can do 
to it is calculating a checksum. It is very simple 
for the computer or a program to check out a 
ROM by adding up the values of all of its bytes 
and compiiring this sum to a known value for 
that panieular ROM, Why do itV The Apple 
//e's self diagnosis (closed apple Reset keys) 
can determine easily if a chip has gone bad or 
a program can determine if you liave changed 
the SFS ROM in order to gain control of the 
Reset key back from them, 

Fonunately, it isn't too hard to deal with a 
ROM's checksum once you are aware of its 
existence, Pmgram I below, "Checkstimmer", 
uses a routine similar to the one built into /,'e's 
and //c's to find the checksum of a ROM, just 
pan of a ROM, or a roultue in memory that 
is going to end up in a ROM. To tell ihe 
program wliai locations lo checksum, you have 
to change the FOR NEXT statement in line 10, 
It is shown set up lor the entire SF8 ROM ot 
an Apple ][ Plus, starting at SFSW) (63488) and 
ending at SFFFF (65535). For an Apple //e or 
//c, you need to checksum their whole ROM, 
$CI00~FFFF, Don't checksum locations 
SCtMO-SCeiFF, Doing so flips soft switches and 
your computer will just go crazy when you try 
it. 

The follownig is an example of how you can 
use this program to alter a ROM and still end 
up with the same checksum as before the 
alteration. 

Lets say you have moved an image of the .SF8 
ROM to SI 000 and plan to modify the 12 bytes 
of it that start at SFCC9 on the original ROM. 
This code would start at $ICC9 in the image 
of the ROM. 

Before making the changes to the RAM copy 
of the ROM, change line 10 ofchecksummer 
to "FOR X = 5321 TO 5340'\ RUN the 
program and write down tlie checksum value 
it comes up with. 

Notice that although we used the correct 
staning address (5321 = S1CC9), I chose an 



ending address that is a numlier of bytes beyond 
the end of the impending changes. I did this to 
allow room for bytes to be changed beyond the 
code changes. This in necessary to balance the 
checksums. You should always allow- more- 
room for your routine than the length of it so 
you can match the checksum. Any bytes that 
remain unchanged just subtract out later. .10 it 
is no problem to have check.su nutter go farther 
than the actual changed bytes. 

Now make the changes ttj the ROM and add 
a couple of zero bytes directly after the changes. 
Run the cheeksummer program agam and 
subtract the two checksum values. If the llnal 
checksum was larger than the original one, you 
need to add more zero bytes following your 
changes. 

Finally, convert the difference in checksums 
to a hex value and replace one of Ihe zeros with 
it. If the difference in checksums is more than 
235, then change one zero to SFF and change 
the Following byte to the difference minus 255. 

You ,';hould RUN the cheeksummer program 
after you are done to confirm that the modified 
code has the same checksum as the original 
code. 

The Don Laucaster "Old ROM" 
Absolute Reset Package 

'fhere have been some questions raised about 
the Don Lancaster absolute "old Monitor" 
Reset seen advertised in various m.iga/.ines. It 
is a really good buy for the Apple //e or //c. 
It comes with a tremendous amoimt of 
documentation, including much detail on how 
LPRt JMs are written to and read from and how 
to build adapters for huriiiiig 27128's and 
2764's on a 2732 EPROM burner. It also has 
patches for the //c and the enhanced //e's. The 
programs and patches are supplied on disk, so 
yon don't have to type them in. And the patched 
ROM's checksum is fixed so that the built in 
diagnostics shouldn't be able to detect that the 
ROM has been modified. This Re,set kit is 
available by contacting; 

Don Lancaster 

Synergetics 

746 First St. POB 809 

Thatcher, Arizona 85552 

(602) 428^4073 

Because Lancaster's absolute Reset is 
designed for //c's and /fc's, where 
COMPUTIST absolute Resets have been 
designed for Apple H's, they are quite different, 
Lancaster's patch resides in the CTD ROM (//e 
& //c ROMs arc 2764's and hold four times as 
much code ."is the ]['s 2716) and is nowhere near 
Ihe $F8 code, 

Don Lancaster didn't have too much trouble 
deciding what routine to sacrifice as room for 
his patch. He placed it right on top of a routine 
that is designed to blast holes in any program 
in memory during a cold Reset (since the //c 
can do a cold boot widiout nirning off the power 
(open apple Reset)). Theiefore, with the 
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LSynergetics absolute Reset you lose nothing and 
gain iKe ability to Reset out of any program 
diretily into the Mimitor, ail for SI 9.50 anJ the 
prici; of a 2764 EPROM. 

Lancaster's Faults 

I am \'t;ry pifky and Ibund iwo things with 
ihc Lancaster Rc^el thai I lek iieedfd (.-hung i rig, 
so I'll give here my patch to his patch. 

Fira of all, his jump into the Monitor leaves 
sonie soil switches used for bank switching 
scrambled, Lancaster explains this in the 
documentation and tells you how to manually 
correct for it. Secondly, it leaves the power up 
byte scrambled, so a subsequent Reset will cold 
boot the maehine. 

You can ri,\ each of these problems yourself 
while in the Monitor by entering "C0P)6:f)W" 
to fi\ the soft switches auU "FB6FG"' tu \\\ 
the power up byte. 

Well, I don't agree with this approach, I 
believe that that the computer is supposed to 
take care of mundane details like these, i 
therefore developed a patch to Lancaster's patch 
which causes it to do these steps automatically. 
But first, why didn't he do this himself? 

The an.swer is .simple: he ran out of room. 
The hole blaster routine that he covered with 
his patch was too small for anything fancy and 
he didn't wish to sacrifice any other routines. 
He felt that the cassette routines were important 
since if you ever blew DOS, you couid still 
recover your data on tape. He didn't realize that 
even if you obliterated the tape load routine. 
you could still save to tape and later use a tape 
load routine from disk to read the inibrmation 
back into the computer. Or better yet, you could 
u,se the dual ROM idea of COMPUTIST No. 
19. 

Using table 2. address $D8C9 seems like the 
best place to put a new routine since you will 
probably want to keep the new patch on the 
same chip with the first patch. Since you will 
be wiping out a routine (the cassette load 
routine), it is a i;ood idea to place some kind 
of warning message there. I usually use ajump 
to SFr2D which rings the bell and prints 
"ERR", Therefore the new patch will actually 
Stan at $B8CC. 

Table 2: 

Possibly Expendable Subrotitin&s 

$D3B0 - oaeS Save to cassette tape 

$D8C9 - 03EF Load Iram cassette tape 

IDSF0 - D900 Get length for 1ape save 

JD901 - 093D Set up for cassette save 

$FCC9 - FCD5 Writes tone header on tape 

tFCD6 - FCEB Write a hit to tape 

iFCEC - FCF9 Read hits trtjiii tape 

IFCFA ' FD0B Sense cassette tape 

$FECD - FEFG Write data to cassette tape 
?FEFD - FF01 Read data frotn cassette 
JFF02 - FF2C Read hi -res from tape 

JF800 - F818 Plot a lo-res point at X,Y 
$F819 - F825 Draw lo-res horizontal line 
IF826 - F830 Draw lo-res vertical line 



Now rliat we have decided to sacrifice a 
routine, wc have enough room for more 
embellishments. Why not change the Reset 
vector (S.'^FZ) to jump into the Monitor on 
future Resets? And also, wouldn't it be nice to 
know where the Reset vector had bteen pointing',' 
For .some pmgrams this is a soft re-entry poitit. 
For others, a whip memory routine with cold 
boot, Either way, it is usually a source of 
valuable information, so let's save the previous 
Reset vector before installing the new one to 
the Monitor. Wc will do this at S2FE and $2Fr, 
the end of the keyboard input buffer. 

Patching the Patch 

There are two steps to fixina; the Lancaster 
absolute Reset patch. The llrst is to change the 
jump into the Monitor fJMP !EFF:s9) with a 
jump to the new patch (JMP SD8CC). n\iiig 
Its checksum as we change the jump instruction. 
Tiie second part is to write in the tiew patch 
routine. This patch will eventually be at $C25C 
so if you have the Lancaster "grabbed" CD 
ROM c(xie staning at IB 1000, then the patch will 
be at S125C. Here is the exact procedure: 

1) Use Lancaster's instructions all the way up 
to but not including burning the F.PROM. 

2) Load the C ROM. 
BLOAD UEMON.C,A$18eB 

.1) Load thcD ROM. 

BLOAD [IEMON.D,A$2ee» 

4) From the Monitor, change Lancaster's jump 
and his checksum fixer byte. 

I2SC:CC D8 il 

5) Enter the leftmost portion of the following 
disassembly. This is our new patch. 



28C9.4C 2D FF 


JMP SFF2D 


tape loa[j=err 


28CC:80 06 C0 


STA SC006 


flip switch 


28CF:AD fZ 03 


LDA S03F2 


save old Reset 


28D2:8D FE 02 


STA Sfl2rE 


vector at {2FF 


28D5;AD F3 03 


LDA S03F3 


& S2FF 


2808:80 FF 02 


STA S02FF 




280B.A9 eS 


LDA am 


set Reset 


28DD,8D F2 03 


STA S03F2 


vector to 


2eE0:A9 FF 


LDA ffSFF 


Monitor 


28E2:8D F3 03 


STA $03 F2 




28E5:20 5F FB 


J£R SFB6F 


fly powerap byte 


2SE8;4C 55 FF 


JMP SFF65 


jump to Monitor 


28EB:FF 




next five bytes 


28EC:6A 




correct the 


28ED:00 




checksum 


28EE:00 






2aEF:00 







6a) If your ROM burner can burn 32K 
EPROMS then save the new code with: 

BSAVE CD,A$lBft0,L$2eee 

6b) If your ROM burner can't burn 32K 
EPROMS then save the new code with: 

BSAVE ROM.r,A$IBflfl,I.$l»flfl 
BSAVE ROM.D,A$2ftB9,L$ie09 

7) Burn a 2764 EPROM with the code from step 



6 and replace the CD ROM on the motherboard 

with it. 

Using the New Patch 

The new patch is used in exactly the same 
way as the old one. but it does give you some 
changes. If you press the Reset key after using 
the Don Lancaster absolute Reset, it will no 
longer cold boot but jump into the Monitor, If 
you look M memory locations $2FE and S2FF. 
you will find the address where the Reset vector 
pointed before using the absolute Reset. 

When Resetting into tiie Monitor with cither 
Lancaster's patch or our new patched patch, 
DOS will be disconnected. This is often helpful 
when breaking into commercial software 
liecause some commercial software set the DOS 
hooks to point to a routine that wipes menitiry 
as soon as any command is typed. You can use 
"3EAG" (for DOS 3.3) or ■BEOflG" (for 
ProDOS) from the Monitor to re-connect DOS. 
If a strange DOS is being used, these commands 
may not have any effect. You may prefer to type 
"E0<MG" to enter BASIC instead. 

Why the COMPUTIST 
Reset Doesn't Always Work 

There are some programs. Such as 
AppIeW titer, Hotncword. Might Simulator, and 
Skyfox, that the COMPUTIST Reset will noj 
escape out of. This is due to the fact that the 
RAM card remains enabled on Apple JL Plus's 
when Reset is pressed, If the commercial 
software has not copied your F8 ROM over into 
it but instead has activated it with their own 
version of the F8 then you will not be able to 
Reset into the Monitor. 

On Apple ][ Plus's when you press Reset, 
the Apple juirips to whatever address it finds 
at $FrrC, but that $FFFC could be the one 
from the ROM or the R.^M depending on the 
.soft switch settings. The only way to break 
ttiroujth these would be with a copy card whose 
hardware is able to control the bank switching. 

On Apple //e's and //c's however, the ROM 
is automatically enabled when the Reset key is 
pressed. Therefore any ROM changes you 
make will b« usable on any program! 



Program 1: Checksummer 

10 FOR X = 63488 TO 65535 

20 IF SUM > 65280 THEN SUM = SUM - 65536 

30 SUM = SLIM + PEEK (X) : NEXT 

40 I F SUM < THEN SUM = SUM + 65536 

50 PRINT "CHECKSUM" =" " :SUM 

cht-ckstims 



10 


- 53eAD 


40 


- JESSE 


20 


- S4FC9 


50 


- $5420 


30 


- $EE3E 
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Requirements: 

128K Apple //c or //c 

2 drives preferred 

SpellWorks 

ProDos User's Disk 

An INlTialized DOS 3,3 disk 

A formatted Pro DOS data disk 

A blank disk 

NMI Capability (or other way to break into the 

monitor) 

SpellWorks is produced by Advanced Logic 
Systems (ALS) and is programmed lo ititerface 
with AppleWorks. On the front side is the 
Spelling Checker with a 90,000-word 
dictionary, On the back side is the Mail Merge 
program. Both sides are copy protected. 

The Spelling Checker is designed to check 
AppleWorks files. When checking a file iinother 
tile called MISSPELL is created in which all 
misspelled or unrecognized words are placed 
in alphabetical order. After the document is. 
spell checked and the MISSPELL file i.^ 
created, you can boot AppleWorks and put both 
the document being checked and the 
MISSPELL fde on the desk top. This facilitates 
the comparison of the MISSPELL file with the 
document beijig spell checked. Unique word.'; 
can be placed in a custom dictionary. 

The Mail Merge program is designed to 
merge two AppleWorks word processor files, 
A typical application is a form letter of some 
sort with as many fields as desired. The list file 



or sets of data 11 le can be created by using either 
the AppleWorks word processor or data base. 
In the lauer case the data base file must be 
printed to the clipboard and then saved as a 
word processor file. With the list file and the 
form letter file on disk the Mail Merge program 
can be run. A merged file will be created and 
.stored on disk under whatever file name 
selected. AppleWorks must then be re-booted 
to examine and prim the merged file. 

In bodi of these SpellWorks programs 
ProDOS conventions must be observed. The 
opening menus provide BASIC program options 
and the additional options of changing the prefix 
and indexing the volume whose prefix is set. 
In the Spelling Checker the index option will 
display all of the files on the volume selected 
without showing the type of file. In the Mail 
Merge the index option will di.splay only 
AppleWorks word proccs.sor files. This is not 
explicitly stated in the documentation; however, 
Mail Merge will work only with AppleWorks 
word processor files. 

Each of the Spell Work.s programs takes 
advantage of the capabilities of AppleWorks; 
but each requires constant operator intervention. 
On the positive side both will get the job done, 
and the cost is reasonable, especially if 
purcha.sed through mail order houses. On the 
negative side there arc several trouble.some 
features. Both programs require the creation of 
files and (he saving of them to the selected 
volume. Yet, in the index (catalog) option on 
each the free space available on a volume is not 
shown. Neither is there a way to determine the 
data disk volume name from within the 
program. These are inconvenient deficiencies 
that could he easily retnedied. In the Spelling 
Checker the alphabetical li.sting of misspelled 
and unrecognized words in a MISSPELL file 
leaves it to one's own devices and knowledge 
of AppleWorks to gel the corrections made. 
Neither displays of flagged words in context nor 
suggMted spellings are featured. In the Mail 



Merge the creation of a merged file could be 
unacceptable if many form letters were 
involved. At besl the file would occupy much 

disk space. If one had a hard drive with both 
AppleWorks and SpellWorks installed, the 
constant flipping between the programs and 
AppleWorks would he facilitated. SpellWorks 
cannot be installed on a hard drive unless it is 
dcprotccted. This provides the justification for 
and the purpose of this article- the deprotecfion 
of SpellWorks for bona fide owners. 

The Protect inn 

SpellWorks uses the ProDOS operating 
system. The discussion given in this section 
describes to some extent how ProDOS boots 
and how the protection scheme is implemented. 
The steps outlined here to determine the nature 
of the protection are applicable lo olher 
protected ProDOS programs. Step-hy-siep 
procedures for deproiecting SpellWorks are 
presented later. 

The use of ProDOS was verified by booting 
the ProDOS Users Disk, enlering BASIC, and 
obtaining a catalog of each side. The volume 
name for side I is SPELLWORKS. The files 
are SPELL. SYSTEM. LEX. CP. PRODOS. 
TMP, and MISSPELL. The volume name for 
side 2 is MAILMERGE. The files are 
CLAUSDB. CLAUSLIST. CLAUSMERGE. 
PRODOS. CLAUSDBLIST. MERGE. 
SYSTEM, CLAUS. and MRGMSG, On this 
side all of the CLAUS- files are a.ssocia[ed with 
the examples provided on the disk. The fact that 
a catalog can be obtained indicates that a near 
normal ProDOS has been used. 

Using a nibble editor I examined the format 
of both sides. As expected, a more-or-less 
standard 16-sector formal is used. The sync- 
byte used is ■■AA" instead of the standard 
■'FF", ProDOS could care less. Also, on each 
track in the large sync-field preceding sector 
$00. founeen (14) non-sync bytes are insened 
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as follows: AD A A tii Kb AE HE AE HE AE 
FE AE AC AC AC. This looks like it eotild 
be an address field: however, standard address 
and data marks toIUriw after another large sync- 
ticld. I believe that the dummy address field is 
inserted to attempt to fool bit copiers that find 
the track start by looking I'or the largest syne- 
field. Al I his point i decided to copy eaeh side 
onto a separate disk using a standard copier, 

I used the copy program on the Pro DOS Users 
Disk, COJ'YA would work just as well. Each 
side copied with no indication of error; 
however, each would hang during boot after 
loading Pro DOS As a matter of interest, I also 
suceesstully bit-copied each side using EDD- 
III with default settings. This produces 
satisfactory, protected backup copies. An 
interesting fe^ituie of bit-copying is that one can 
syf the tntck lengths. Iht: track lenjjlhs of ihe 
original are extremely short. The corresponding 
copied tracks arc approximately S80 bytes 
longer with the copy drive running at the 
standard speed of 300 revolutions per second. 
This; indicates that no track length cheek is being 
done. 

It will help to understand a little about the 
Pro DOS operating system. Most of us arc 
comfortable with DOS 3.3 becatiae we have 
worked with it for a long time. Conversely , wc 
are not ;tt; comfortable with ProDO.S yet. Since 
ProDOS is it superior operating system we must 
take the plunge and learn it. During (he boot, 
PruDOS is loadad inio RAM. It then loads the 
tir.st ■■x\xx. SYSTEM" file it can find at 
memory location J20M and then executes it. 
Usually, this is BASIC, SYSTEM, but it can be 
any system file. If it is BASIC.SYSTEM, 
control is passed back to the BASIC tnterpreter 
(Bl): and a BASIC file. SrARl'UP (ProDOS' 
equivaleni of HELLO), is ran If it can be found 
on the disk. Otherwise, the machine is left in 
BASIC as indicated by the BASIC cursor.-]". 
A custom system file does not have to pass 
control back to BASIC. It can provide its own 
interpreter. Therefore, the system file is a good 
place for someone wishing to protect a program 
to bury ihcir protection scheme. To determine 
the n attire of the protection used in the 
Spell Works programs, I decided tu to sec if 1 
could run either program fi'otn a ProDOS 
BASIC environment. With the ProDOS Users 
Disk in drive 1 .'ind the protected program disk 
in drive 2, 

II Boot the User's Disk and enter BASIC. 

2) Set the prefix of the protected disk. 
PREFIX,D2 

3) Run the system tile. (SPELL. SYSTEM, Side 
I; MERGE, SYSTEM. Side 2). 

-SPELL.SYSTEM 

If the protected program eiiecutes and 
functions normally, a standard ProDOS is being 
used and the protection is contained in the 
system file. Following the above procedure, 
both sides of SpellWorks execute und function 
normally. The next step is to find where the 
protection is in the system file and then 
circumvent it. Ii has already been determined 



that the standard copies hang after loading 
ProDOS. A disk monilor would help greatly .it 
this Stage to find out exactly what i.s happening 
when the programs hang. Fortunately, such a 
monitor is avadablc in COMPU TIST No. 21. 
It is called Proshadow. This is a great little 
program that monitors what the disk is doing, 
1 patched Proshadow so that ii would leave its 
display on the screen, ConUnuing. if one can 
find where the copies hang, one is close to what 
one needs to knt>w. To do this I rebooted 
ProDOS into BASIC and then "BRUN 
PROSHADOW". With Proshadow installed I 
executed steps 2 and 3 above using the standard 
copies in drive 2. The Spelling Checker, side 

1 , reads the file "TMP" and then hangs in the 
file "CP". This mformation is not directly 
di.splayed. The display shows whether the disk 
head is reading, writing, or fomiatUng; the slut 
and drive numbers; the memory buffer being 
accessed; and the corresponding block 
mmibers. In other words. PROSHADOW tells 
one what is happening and where it is 
happening. To translate this information into 
file names means that one must know where the 
files arc on the disk in terms of ProDOS block 
numbers. Copy ][ Plus fi.0 has a disk map 
fiinction that works with cither ProDOS or DOS 
3.3. The files can be located on the disk in terms 
of DOS 3.3 logical .sectors. DOS 3.3 logical 
sectors can be translated into ptiysical sector 
numbers which can then be expressed in terms 
ol PruDOS block numbers. Quality Software's 
■'Reneath Apple DOS" and "Oeneath Apple 
ProDOS" are indispensable references lor 
anyone doing this kind of work. If these books 
are not available, the article "DOS to ProDOS 
and Back" in COMPUTIST No. 25 contains 
the appropriate translate table. Following ihe 
same procedure, the Mail Merge program, side 

2, hangs in the file "MRGMSG", Armed with 
thi."; knowledge, the system fdes will be closely 
examined. 

In the following. 1 will examine the Spelling 
Checkei" first and then give the same appropriate 
treatment to the Mail Merge program, The 
system file could be loaded into memoi7 at 
location SZtXTO and examined; however, due to 
the disk access involving the files "TMP" and 
"CP". it is better to run the system file using 
the original disk and the interrupt it. Repeat 
steps 1 , 2 and 3 above using SPELL.SYSTEM. 
Interrupt the program at the first inenu and enter 
the monitor. As explained below in the Step- 
By-Step section, .Spelling Checker cannot be 
interrupted by simply pressing Control-Reset, 
A direct reset to the monitor or a nan-maskable 
interrupt capability is needed. Conversely, Mail 
Merge can be interrupted with a control -reset 
keypress. Continuing with Spelling Checker, 

4) enter the monitor and disassemble the code 
starting at 52000 with the "L" command (as 
in 2B99L) and follow along with the discussion 
below. Type another "L" for each screenful 
of code. 

At S20fl0 the execution immediately jumps 
to $2088 wiiere the kernel and inteipretei" aie 
initialized and some memory management takes 
place through $209F. At $20A I is a ISR (jump 
to .subroufine) to SBFOt'). This is the entry to 



the Machine Language Interface (ML!) in the 
Pr-oDO.S kernel. Twenty -six (26) different 
functions may be performed to access and 
manipulate files. Beneath Apple ProDOS 
describes all of thc.se operations well, Just 
enough information will be given here for one 
to follow- whal is happening. 

After a call to SBF00, ProDOS expects lo 
find two data items following the JSR 
in.struction. Byte fl (the first byte) defines the 
function code. Bytes 1/2 define the address of 
the parameter list in lo-hi form. Referring to 
$20A1. there is a $C8 at $20A4 which is the 
code to open a file The next two bytes point 
to the address S457D for the parameters of this 
call. The format of the parameter list is as 
follows: the zero byte (M57D) is an 103 which 
means there are three parameters to follow: the 
1/2 bytes ($457E and $45 7F) poinl lo liie 
address of the file's pathnanne in lo-hi form 
(S459A); the 3/4 bytes poinl lo the buffer 
address used by MLI while the file is open; atid 
byte 5 is the reference number assigned to this 
open file ($A0 in this case). If one disassembles 
the code beginning at $459A and deciphers the 
hex code into ASCII, he will find 
"/spell works/tnip" as the pathname. Do not 
worry about the lowercase letters. ProDOS will 
accept either lowercase or uppercase. So. we 
have discovered that the file TMP has been 
opened. Examining the code from $20A1 
through $210,"! shows that the following 
functions are being done through the MLI: 

I20A1 open TMP as described above 

I20E8 write $200 bytes at $6000 to THP 

J20C3 open CP 

$20D4 read CP into AS6000, L$0200 

$20DC JSR to $6000 (do protection code) 

J20E1 an endless loop if checks fail 

J20E4 close CP 

S20EC reset the data pointer Ot TMP to 

S20F4 read THP into AS6000. LI0200 

S20FC Close TMP 

$2104 start of program if ctiecks pass 

From the above summary, space is made in 
memory at $6MXIi by writing $13200 bytes to a 
temporary file on disk named TMP. Then, the 
file nanied CP, the copy piotectitm code, is 
loaded into $6000 and executed. After this an 
endless loop is encounteied if tlie checks fail. 
The file CP is closed. Then, ihe TMP data 
pointer is reset to die zero position, and the code 
stored in TMP is loaded back into memory 
where it came from T.MP is clo.sed. and the 
execution falls through to the start of the 
program at $2104. Detailed examination of the 
code shows that the execution of the protection 
code at S6000 alters SPELL.SYSTEM in 
memory pages $27 and S41 through S45. 

Tlie same type of information derived above 
tor the Spelling Checker can be obtained for 
the Mail Merge. Run MERGE. SYSTEM as 
done above and interrupt the program by 
pressing Control-Reset. Disassemble the code 
beginning at location $2000. Briefly, this code 
initializes the kernel and interpreter, performs 
memory management, and set up some page 
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$33 data between addresses SZmO and %2mn. 
At S2H4F, is I he first call to the MLl. A 
summary of what happens follows: 

i204E open MRGMSG 

$2056 set up an endless loop 

$2071 read MRGMSG into A$50B0. LSiSD 

$2079 JSR 16000 (execule fjrotection code) 

J207E slart of pTogrsm if all checks clear 

The Mail Merge program protection is 
similar lo the one used for the Spelling Checker. 
As summarised above, the system file opens 
MRGMSG. a llle containing a merge message, 
reads it into memory at S6000. and then 
ewi-utes it. [fall ihc ehccks clear, the execution 
of the code falls through to the start of the 
pi-ogram at $2ei7E, If the ehcckn fail, the 
execution goes into an endless loop at $2056. 
Detailed examination ot'ihe protection code at 
S60fl0 shows that its execution modifies 
MERGE. SYSTEM in mcmoiy pages S33 
through S'^6. 

The Deprotection 

Each of the Spell Works programs uses a 
protection scheme that involves loading code 
froni llie disk, performing cheeks, and 
modifying the system file in memorv before 
jumping to the start of the program. With the 
knowledge derived in the last section, it should 
be possible to run the original programs and let 
them .satist>' all of the protection checks. Then, 
interrupt each ai the ilrst menu, patch the system 
code to bypass the checking part of the code, 
and jump directly to the start of the program. 
The entire modified code can he saved back, to 
the disk as a modified system file. BefOre saving 
this to disk, the validity of this approach can 
be checked by executing the modified code from 
the monitor. This was done succes.sfnlly for 
each piograiu, A slep-by-step dcprotcction 
procedure follows for each program. 

Spell Checker Step By Step 

Spell Checker cannot be interrupted with just 
Control -Reset. A direct reset to the monitor or 
a non-maskable interrupt (NMD capability is 
needed, f use (he Senior PROM marketed by 
Cutting Edge Enterprises, Tlie procedure 
involves the interruption of the program at the 
first menu, the patching of the code in memory. 
and the saving of the whole thing. The saving 
to disk step is involved because 
SPELL. SYSTEM is rather long. S7fl0I bytes. 
It cjinnot be saved directly because the 
BASICSYSTEM file is not present. Even if the 
program is run from a BASIC environment, the 
BASEC, SYSTEM file is overwritten or 
disabled. The modified SPELL.SYSTEM 
occupies memory from $2000 through S9O01 . 
There is no place in memory where it can be 
put without its being overwritten by any 
subsequent rcbtMii of a ProDOSdisk. However, 
the memory area in question is not overwritten 
by a DOS .l."! slave disk. Therefore, a DOS i.i 
.slave disk will be warm booted and the file will 
be .saved as a DOS binary file. It will then be 
converted to a ProDOS system file and saved 
over the copy disk's protected 
SPELL.SYSTEM. 



1) Copy the Spell Checker using a staiidard 
copier. 

2) Boot the original Spell Checker and Interrupt 
the program at the first menu using your 
favorite tnethod. 

i) Enter the monitor and patch Spell Checker 
to skip I lie protection, 

2eAl;4C »4 21 

4) Ins en a DOS 3.3 slave disk in drive I and 
type 6| i'jP| to boot. 

5) Save the patelied SPELL.SYSTEM to disk. 

IJSAVESI'ELL.SYSTEM,A$2fl()fl,L$7flei 

6) Boot the ProDOS users disk and rtm the 
CONVERT program. 

7) With the DOS 3,3 disk containing 
SPELL.SYSTEM in drive 2 and a ProDOS data 
disk in drive I, SET ProDOS Prefix and 
TRANSFER SPELL.SYSTEM to the ProDOS 
disk. 

8) Place the ProDOS users disk in drive I and 
the ProDOS disk containing SPELL.SYSTEM 
in drive 2. Select the QUIT option of the 
CONVERT program, and run 
BASICSYSTEM when prompted . 

9) Load the SPELL.SYSTEM that you just 

converted from DOS 3.3 into memory. 

BLOAD SPELL. SYSTEM, A$2eee,D2 

10) Insert the copied version of Spell Checker 
in drive 2. 

1 1 ) Tell ProDOS to do everything on drive 2. 
PREFIX,D2 

12) Replace the protetled SPELL.SYSTEM 
with the modified SPELL.SYSTEM. 

UNLOCK SPELL.SYSTEM 

DELETE SPELL.SYSTEM 

CREATE SPELL.SVSTEM,TSYS 

BS.4VE 

SPELL.SYSTEM,TSYS,A$29ee,L$7eO 

/I 

LOCK SPELL.SYSTEM 

DELEIE IMP (optional step) 

DELETE CP (optional step) 

Spell Checker is now completely 
dcproiected. and it can be installed on a hard 
drive. It can also be copied by COPYA or any 
.standard copier. 

Mail Merge Step by Step 

The Mail Merge program is not as 
complicated to depiotect as the Spell Checker. 
It can be interrupted at the first menu with a 
Control -Reset keypress. Coiisequently, it will 
be convenient to use the ProDOS u.sers disk a.s 
much as possible. The copy procedure follows; 

1) Boot the ProDOS Users Disk 

2) Select the FILER utilities and then the 
VOLUME commands. 

3) Select the Copy program, insert a blank disk 
in drive 2 (use the back side of the Spell 
Checker that was just deprotected), and copy 



Mail Merge. 

4) Return to the menus, Qnit, and run 
BASICSYSTEM (go lo BASIC). 

5) Delete the old MEKGE. SYSTEM and 
CREATE a blank .SYSTEM file. 

PREFIX, 1)2 

UNLOCK MERGE.SY.STEM 
DELETE MERGE.SYSTEM 
CREATE MERGE.SYSTEM ,T.SYS 

(j) Insert the original Mail Merge in place of 
the copy and type: 

-MERGE.SYSTEM 

7) At the first menu, drop into BASIC by 
pressing Control-Reset. 

8) Patch the MERGE.SYSTEM in memory to 
skip the protection. 

CALL- 151 
2B4E:4r 7E 2B 

9) Boot a DOS 3.3 slave disk by typing C6«eG. 

10) Save MERGE.SYSTEM to the disk. 

BSAVE MERGE.SYSTEM.TSYS 

,A$2Bee,L$25e4 

11) Boot the ProDOS User's Disk and use the 
CONVERT utility to transfer the patched 
MERGE.SYSTEM from DOS 3.3 to a ProDOS 

data disk. 

12) Exit the CONVERT ufiliiv .■nnd Ouit to 
BASIC, 

13) Load MERGE.SYSTEM into memory. 
BLOAD MERGE,SYSTEM,AS2»ee 

14) Insert the copv disk and save the new 
.SYSTEM file. 

BSAVE MERGE.SYSTEM, rSYS 

,A$2eee,LS25e4 

LOCK MERGE.,SYSTEM 

DELETE MRGMSG (optional) , 

Mail Merge i.s al.so compielely deprotected 
and can be installed on a hard drive. 

Reflections 

In the procedure 1 have used to de protect the 
SpeilWorks programs it has not been ncx^e<,sary 
to analyze the actual protection being employed. 
However, the modification of the respective 
system files has been captured and the 
protection circumvented thereafter. For 
instance, it has not been determined whether 
or not the protection actually does a signature 
clieck of the dummy address field prior to sector 
$00 on each track. ALS has obfuscated the 
protection code loaded into %6W& very well. 
All of this is bypa.ssed with the interrupt after 
the protection has been executed. It is likely that 
ALS uses this type of protection on other 
software. If so, (hose products can probably be 
deprotected in the same manner. 

Thai's all folks. 
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Bootcode Tracing... 




Rich Etarip 



Brodefhund Software 

J 7 Paul Drive 

San Rafael, CA 94903 



Requirements: 

48K 

Initialized disk witfi no Hello program 

Gumball Diskette 

For myself, I rauld call Broderbund's 
Gumball two games on one disk. First, there 
is the arcade type game where the object is to 
sort the colored gumball s in die proper colored 
containers. Then there is the mind boggling 
game called ' 'Btxit Code Trace The Disk". The 
object of this game is to control the boot process 
up to the point where the game is loaded in and 
then save the game on normal DOS 3.3. Since 
Gumball is a challenging game and 
Broderbund's protection is no less challenging 
to break, I hesitate to say which game is easier. 
With enough time and dedication, though, both 
games can be conquered. 

In this article. I will focus on the techniques 
used to win at the second game: deprotecting 
the program. 

! knew I was in for somewhat of a challenge 
when I began tracing the boot code on this disk. 
The last Broderhund game I deprotected was 
Puck Man a few years ago. Since then, our 
friends at Brodcrbund have really progressed 
in die complexity of their boot codes. If I 
remember correctly. Puck Man had a mere 
three boot stages which doesn't compare to the 



nine that Gumball has. Fortunately, you will 
not need to trace through all of them. More on 
that later. 

Right now i: is time to start in level I of our 
game. 

1) The first step is entering the monitor to begin 
the boot code trace, 

CALL -151 

2) Next, we want to move the boot program 
at SC600 to a place in memory where we can 
modify il to read in the first boot stage and 
return control to us. The code at $C600 is 
relocatable anywhere in memory but I like to 
use $9600. 

96ee<C6*W.C6FFM 

3) Now, if you look at $96F8, you will see a 
JMP $801. Thi.s is where the first boot stage 
begins. If we change that JMP instruction to 
jump to the monitor the first boot stage will load 
in and we will have control of it. We will 
change the JMP $801 to a JMP $9801 and at 
S9801 we will put a routine to turn off the drive 
and jump to the monitor. 

96FA:98 N 9881: AD E8 Ce 4C 59 FF 

In case you are confiised by the "N" between 
instructions here, this is the monitor's 
"Normal" (rather than "inverse characters") 
command. It can be used to separate 
instructions, kind of like a colon in a BASIC 
program. 

4) At this point we are ready to execute the boot 
at $9600. 

96fl(tG 

5) When the drive stops we will move the boot 
code at page $8 to page $98 and change a few 
bytes so it will run at diat location. 

98ee<8e».8FFM 



6) If you list through this boot stage you will 
see that it relocates itself to page $2 and jumps 
to $20F. We have to change it so it moves page 
$98 to $200 rather than page $8 because page 
$98 is what we are working with. 

9805:98 

7) Looking at $9837 you will see a JMP $301 
which is the jump to the next boot stage. If we 
change this to jump to the monitor, boot stage 
2 will load in and we will again have control 
of it. 

9838:59 FF 

8) We are now ready to execute the boot 
program at $9600. 

96eflG 

9) When the Apple beeps, turn off the disk drive 
motor by accessing $C0E8, 

C»E8 

10) Biwt stage 2 is now loaded in at $300 and 
we can move it to page S93 to modify it. 

93»fl<3fle.3FFM 

!1) We also have to change the jump that exits 
boot I to jump to the modified boot 2 at $9300. 

9838:ei 93 

12) If you list through page $93 you will see 
that il clears hi-res page 2 ($4000) and docs 
some memory decoding. At ihe end you will 
find it loading the X register with #$CF. 
transferring it to the stack pointer and executing 
an RTS. This is an encoded jump since an RTS 
instruction takes two values off the stack and 
jumps to that address plus one. These encoded 
jumps are scattered generously throughout the 
boot making it a bit harder to trace. What we 
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want to do is write a short routine to pull the 
two top values off the stack and store them 
somewhere so we can see wiial they are, We 
will put our routine at $9500 and jump there 
at the end of boot stage 2. 

932B:4C W 95 

95m:A2 CF 9A 68 8D m 2« 68 

95ft8:8D ftl 2ft 4C 59 FF 

13) Thai little routine sets the stack pointer at 
#$CF, pulls two values off the stack and stores 
them at S2000 and S2(M1 . Everything is set and 
the boot program can be exeeutet! again, 

14) When the Apple beeps again, turn off die 
drive and check locations 312000 and $2001 to 
see where boot 2 is jumping. 

Cft£» N 2ee».20fti 

15) You should sec a S2F and a $01 . Adding 
1 tothai, you can see that it is jumping to $01 30. 
The routine at $130 is not loaded in from the 
disk, though. If you look at S9320you will see 
that it is moving page $3 to page $1 . but in the 
process, Dxclusive-ORing the bytes witli tise 
value at location $48, Now rather than going 
through this process every time. I prefer Iv 
modify this code before it is moved to save 
some confusion. First, we should move the 
decoded memory back to page $93 where it 
came from. Actually it came from page $3. but 
remember, our puge $3 is at $9300. 

933»<13«.1FEM 

16) Now we have to change boot 2 so it moves 
this routine from page S93 instead of page S3 
antl remove the F,OR instntction. 

9322:93 EA EA 

17) If you examine the routine that goes at $1 30 
you will see that it is loading in the next boot 
Stage at puge S4, which is the text page. We 
cannot modify code when it is on die text page 
because it will stToU off the screen after we 
change it. So, we will have to change tlie routine 
so it loads into safe memory like $6400 and later 
memory move it back to S4O0 after we change 
it. At $130 the X register is loaded with $04 
which specifie.q page $4 but it also uses diat for 
a counter to load in 4 pages of memory. If we 
change it to a $64 it wilt load into $6400 but 
it will also attempt to load in $64 panes of 
memory which we don't want. Location S86 
is used for the page counter so we want a $04 
in this byte. What we can do is change the 
routine at $130 so it stores nothing in $86 and 
put a $04 in $86 before jumping there. Since 
we are jumping to location S9500 upon exit of 
boot 2 we can do it right here and then jump 
to $130 

9Se3:A<> ft4 85 86 68 68 4C 39 fll 

18) We also have to change the routine that goes 
at $ 1 30 to load into page $54 but not store a 
$64 in location S86. 

9331:64 EA EA 



19) The next .step is finding the jump that exits 
the routine at $130. Al $937D is another RTS 
(I warned you) and this h where the boot is 
exited. Again, we will have to jump to a routine 
lo pull the values off the stack and store them 
at $2000 and $2001, 

937D:4C le 95 

951B:68 SD »fl 20 68 80 ftl 28 

9518:4C 59 FF 

20) Again, we are all set to execute the boot 
program at S9600. 

96600 

21) The text page boot is now loaded in at 
S6400. Turn off the drive and check locations 
$2000 and S2001. 

c»E8 N 2efle.2efti 

22) They should be $FF and $03 so the next 
address jumped to is $400. Now we must 
change the routine at $1?0 so it will load ifie 
text page boot where it belongs. If we did not 
do this, the hoot stage would load right over 
our modified boot code at $6400. Once we 
modify the code at $6400, it can be moved lo 
the text page and executed. This step will 
change the routine at $1 30 back to what it was. 
Remember. S9330 is moved into $130. 

9331 :»4 86 86 

23) Now write a memory move at $9510 to 
move the text page boot code back to the text 
page and then jump to $400. 

9510: A2 ftft BD 60 64 9D ftt» 94 
9518:UU («t 65 9D tW 05 BD 00 
9520:66 9D ftft 06 BD 00 67 9D 
9528:eB 07 E8 DB {i:5 68 68 4C 
9530:00 04 

24) Now the code that loads into the text page 
moves pages $5 through S7 into SBD through 
SBF. Then it loads in another boot stage at $500 
and jumps to it. This boot stage loads in yet 
another at 5 i00. The first time I traced through 
diis boot code, I found that it ends up back at 
the original text page hoot, which would then 
be at $BD00, Knowing this, it would be 
pointless to go through the two extra boot stages 
that load in at $500 and $100. Ii could be 
described as running around the block to get 
to your house when you are already there. If 
you list through page $67 (which will be at 
.$BF00) you will Inid valid machine code up to 
$679 F. then garbage... or so it seems. If you 
look at the routine at $G6B0 you will see that 
it decodes the mcmoiy from $BF9F to $BFFF 
by means nf Exclusive OR iiig. Rather than 
letting the boot routine it.self call this routine, 
we will execute this routine and see what lies 
benealh the encrypted code. Since pages $RD 
through $BF are at $6500. we will have to 
modify the routine at $66B(5 to decode the 
memory where it is, 

66B4:67 N 66B7:66 N 66BA:67 

25) Now we can execute this routine and put 
an RTS at the start so it will no longer be used. 

66BftG N 66B0;A2 60 69 



26) We must load the X regi.<;ter with $60 
because that is done by the routine before 
returning. If you list through page £67 you will 
.see some values being pushed on the slack at 
$67E3 and then an RTS. Having gone through 
this boot code prior to writing this article, I 
found that the RTS will cause a jump to zero 
page location S0fl3C. If you were to stop the 
boot at Ihal point and look at $3C through $3E 
you would see 003C- 3C 00 3F which is noi 
rational machine code. The reason is that those 
locations are used by the monitoi and ihey 
become overwritten when you use the monitor, 

Fortunately for you, I went through the 
tonure of tracing this boot code time and time 
again lo find out where everything was jumping. 
At location S003C is a IMP $B200 before it gets 
overwritten. If you were to put a jump to the 
monitor at $67IL3 and execute the boot, you 
woidd eventually come up with the title program 
for Gumball after tracing through 3 mote shorl 
boot routines. What one would usually have to 
do in a situation like this would be to load iu 
the title program, trace through it. and find the 
program's load routine. In this case, thotigh, 
we don't have to. Btoderbund uses a universal 
loading routine at $BF6F. This load routine 
consists of 4 somewhat simple stages and the 
exit from the first one is at $BFE.3. Vou would 
find this at $67E3 becau.se this code is first 
moved to the icxt page by our routine and then 
to pages $BD Uiroiigh $BF. The boot code will 
First go to $BF6F to load in the title program 
and then again to load in the game afterward. 

What we can do is put a IMP $BF00 at 
$67K3 , "Ihen we can write a routine at $BF00 
that will change the J MP $BF0^ to a IMP 
$FF59 and jump to S003C to continue loading 
in the title page That way, when the game 
begins loading in, the boot routine will jump 
to SFF59 this time instead of $BF00. I chose 
$BF00 for the routine because it is just the reset 
routine that clears memory and reboots. Right 
now $BF00 is al $6700 so we have to write the 
routine at $670^. We must also put a jump to 
our routine at $67E3. 

6760:A9 59 8D E4 BF A9 FT 8D 

6708:E5 Bh' 4C 3C 00 
67E3:4C 09 BF 

27) Now we are ready to execute the boot 
routine again. When the title program begins, 
press a key and the drive will start, and you 
will have control. 

9600C 

28) The boot code would have initially jumped 
to SO03C and at $003C is a JMP $B200 so, with 
the drive still running, list through $B200. At 
$B2flC is a IMP $B500 which is another boot 
stage, so cliange ii lo a IMP $FF59 and execute 
$B200. 

B20D:59 FF N B20»G 

29) When the Apple beeps, mm off the drive. 
CftES 

30) If you list through $B500, you will see a 
ISR $B7flfi and a few other instnictioiis before 
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a JMP .$16C4, At first I was fooled but later 
1 learned that it never returns from the JSR 
$B7M. Listing through $B700, at $B713 is an 
ADC SB7B9 which is not really suspicious 
looking initil you look at the instniction before 
it. At SB710 is a DEC $B713 and that 
instruction turns the ADC $R7BQ (at $B71.T) 
into an indirect jump u> SB709 which would 
actually be a jump to S300. If we pul a jump 
to the monitor at $B710 then we ciin take contnji 
before it jumps to S3M. Make this modification, 
turn on the drive and execute the code at $850(3. 
This will load in almost all of the game. 

B71»:4C 59 FF 
C(tE9 

Bseec 

31) Now turn off the drive. 
CUES 

32) When you list through $?tV)%, you will see 
it pushing values on the stack and you will sec 
another example of self modifying code. At 
$375 is a DEC S378 and the byte at S378 is a 
S29. When decremented it becomes a If28 
which is the code for a PLP (pull processor 
status from stack) and then at $!179 is a DBC 
$37C and at $37C is a $61, When decremented 
ithccomes a $6fl which is the code for an RTS. 
Whut IS done here is simply a PLP and an RTS. 
Rather than bother with the self mtxli lying code, 
we will just exit tlw boot stage at $375. 

Since this is the very last boot stage (yes, AT 
LAST!) wc must jump to a routine that will .s;ave 
the lower pages of memory that become 
scrambled such as the zero page, the stack, and 
the keyboard buffer. I find it best to save pages 
SO to $3 because sometimes programs use the 
data stored in them In this case it doesn't 
appear so at first but the later levels will not 
work correctly without them. Since $BF00 is 
only the Broderbund reset routine, we can put 
our routine there. In this aiutine we also have 
to pull the processor and check the values on 
the stack. From my research I found that four 
values must be pulled from the stack because 
the first two point to .$BEB0 which is a routine 
that ends in an RTS, The 3rd and 4th values 
will be the values for the jump to the start of 
the game. First we will change $373 to JMP 
SBFM and then write the routine. 

375t4C M BF 

BF»0:28 68 68 68 8D 00 44 ^ 
BFe8:8D 01 44 A2 00 BD ee 00 
BF10:9D m 40 BD m t»l 9D 00 
BF18:41 BD 00 02 9D m 42 BD 
Bi<20:00 03 9U 0t) 43 £S D0 E5 
BF28:4C 59 FF 

'I'ype BFOBL and compare it with the following 
listing to assure that it was entered correctly . 



BF10- 


?D 00 40 


STA W000,X 


BF13- 


BD 00 0i 


LDA M100,X 


BF16- 


9D 00 41 


STA $4 100.x 


BF19- 


BD 00 02 


LDA $0200, X 


BFIC- 


9D 00 42 


STA $4200. X 


BFIF- 


BD 00 03 


LOA $0300. X 


mz- 


9D 00 43 


STA $4300. X 


SF25- 


E8 


INX 


BF26- 


m E5 


6NE $BF0D 


BF2e- 


4C 59 FF 


JMP $FF59 


BF2B- 


00 


BRU 



BF00- 


23 


PLP 


BF01- 


68 


PLA 


BF02- 


68 


PLA 


BF03- 


68 


PLA 


BF04- 


8D 00 44 


STA $4400 


BF07- 


68 


PLA 


BF08- 


8D 01 44 


STA $4401 


BF0B- 


A2 00 


LDX #S00 


BF0D- 


BD 00 00 


LDA $0000. X 



33) Continuing on, the values pulled from the 
stack will be stored at S44M and S:4401 and 
pages $0 through $3 will be at page $46. This 
is a sate place to store memory because I found 
it to be a blank hi -res page. Now all we have 
to do is turn on the drive and execute 53B0. 

C«E9 N 30«G 

34) When you hear the beep the game will be 
completely loaded in. Now cheek locations 
$4400 aiid $4401 to see where it was jumping. 
It should be $F8 and S3 1 . If not, you may have 
done something wrong along the way. If 
everything is right, then you are ready for the 
next step. The program goes from SS00 to 
$B100 so we have to move the code that 
occupies the DOS area somewhere else. We still 
have the rest of hi -res page 2 to work with so 
this is a good place to move it. We will move 
pages $95 through $B0 into $4490 so we will 
be saving everything from $800 to S95M, 

4400<95»0.BflFJTVI 

35) Wc must also move page SS to a safe place 
so it is not overwritten when we reboot DOS. 
We can put it at $9500. 

950fl<;800,8FFM 

36) Now insert a 48K slave disk with no hello 
program and reboot DOS, 

6 Bf1 

37) Next, enter the monitor and then move page 
$95 back to S800 where it belongs, 

CALL- 151 
8«0<9S»0.9SFFM 

38) Now we must write a memory move routine 
to restore pages $0 to $3 and pages ,$95 to $B0. 
Since there is just junk' memory in page $42 
(which moves to page 2) we can put it right 
there, 

4200:A2 00 BD 00 40 9D 00 00 
4208:BD 00 41 9D 00 01 BD 00 
4210:42 9D 00 02 BD 00 43 9D 
4218:00 03 E8 D0 E5 BD 00 44 
4220:9D 00 95 E8 D0 F7 EE IF 
4228:42 EE 22 42 AD IF 42 C9 
4230:60 D0 EA 4C F9 31 

After entering this routine, type 4200L and 
compare it to the following listing to make sure 
there were no typing errors, 

4200- A2 00 LDX nm 

4202- BD 00 40 LDA S4000,X 
4205- 9D 00 00 STA S0000,X 

4203- BD 00 41 LDA $4100, X 



420B' 


9D 00 01 


STA 40100, X. 


420E- 


BD 00 42 


LDA $4200, X 


4211- 


9D 00 02 


STA $0200. X 


4214- 


BD 00 43 


LDA $4300. X 


4217- 


9D 00 03 


STA $0300, X 


421A- 


E8 


INX 


421S- 


D0 E5 


BNE $4202 


421D- 


BD 00 44 


LDA $4400, X 


4220- 


9D m 95 


STA $3500, X 


4223- 


E8 


INX 


4224- 


D0 F7 


BNF $42 ID 


4J26- 


EE IF 42 


INC $421F 


4229- 


EE 22 42 


INC $4222 


422C- 


AD IF 42 


LDA $421F 


422F- 


C9 60 


CMP ^$60 


4231- 


M EA 


BNE S421D 


4233- 


4C F9 31 


JMP S31F9 



This will perform die memory moves and jump 
to the start of the game at $31F9, 

39) We also have to pul a jimip lo this rouLme 
right before the start address of the program. 

71D:4C 09 42 

40) A few modifications must be made to the 
game so it will not attempt to access the disk 
for the cartoons or high scores. From examining 
the boot code, I found that it uses the address 
of the character output routine ($FDED) for die 
disk access routine, 1 searched through the 
program for the bytes $F,D and $FD and made 
the necessary changes, 

10FA:4C E5 10 
5SC7:EA EA EA 
1SB6:60 
15C4:60 

41 1 A modificatioji must also be made so the 
game will end after level 5. The reason this 
change must be made is that the game normally 
ends during the canoon if you complete level 5. 

10CA:C5 
3560:06 

42) All we have to do now is patch DOS so we 
can save a file longer than $7FFF bytes and then 
wc can save the game, 

A964:FF 

BSAVE GUMBALL,A$7FD,L$8D03 

Now you have yourself a BR UN able file of 
Gumball, For some strange reason (which I 
can't explain) levels 3 and up will not work if 
yon Bl.OAD the game and execute $7FD. If 
you BRUM the file, however, it will work fine. 
I have also included an APT or r.ither a cheat, 
for Gumball, At locations $5 DBS through 
$5DBC are the required quotas for levels 1-5 
respectively. 'ITiese locations can be changed 
to make it easier (or harder). 

Remember UiiS you must save the altered fde, 
and coldstan the computer before BRUNing the 
game. Why this has to be done I can't explain, 
but as I mentioned earlier, level 3 wdl not work 
if you do nol do this. Good Luck! 
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Lucky Day 

Found: One (Count it — 1 ) copy of issue No. 6. 

Softkeys Include: I Pandora's Box I Donkey Kong I Caverns of Freltag | 
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Articles Include: | Gatllng into DOS With DISKEOIT I An Inside look at disk 
farinats using DISKVIEW | Super lOB v1.2 I A quick and easy way to 
Unlock Kyperspacc Wars I Taking a peek at Boot Code Tracing | 
introduction to 'PARMS' | Locltsmith Parameters ; Nibbles Away II 
Parameters I Back it Up II + Parameters I Copy II Plus Parameters I Curing 
those Auto-Start ROM blues Hardware Solutions | A Menu Hello Program | 
Using Both Sides of your Diskettes Advanced Playing Technique for 
Castle Wollensteln ! Learn to use and understand Strings with Text 
Invaders | Getting fnto Hi-res with Zyphyr Wars i Price: S1S.95 ea. 

First Come, first served- Some issues may be slightly darmageri. Otter good 
to currsnl subscribers only. No reservations a i lowed, prepayment only with 

Z4*. To order, phone {206) 474-3750. Please tiave subscriber ID number 
and ship to flddre.';s ready. Normal back issue rates apply to foreign orders, 
Washington Stale residents add 7.3% sales tan. 






OISC 

iCOMMflKDER 



■ DISK COMMANDER is 
a disk editing system for 
DOS 3.3 or DOS 3.3 
w/Pronto-DOS Enhance- 
ment • 4 Editors • 13 Sub- 
editors * Completely menu 
driven • 1 or 2 drive opera- 
tions • INSTRUCTORIALS 
and TECHNICAL INFORMA- 
TION on disk » Sort catalog 
entries * Create multiple heading 
datalagB • Create mulK-column 
ratatogB » Reus sign lock ('unlock and 
tile type symbols, spaces, columns, 
t;atalDg t^eadtng and prD^ram (inss to 
any romhlnnitf^n al NOnMAL. FLASH, 
INVERSE. LOWER CASE or CONTHOL 
tmflraciu^s ■ ReriBm? an DOS c^>mrri»rid* • 
RawrL^ «yj>p4jl£rcr nuiujaj -jMiiSli 
VTDC 

secT 

iicf 

HEU - - 

Mski iiitln^UimiL iMfelt nww" ir«;.(i>»tiui. >»mr> 

iiiinu ttthi DtVYtH. ind mori 

□ DISC COMMANDER 
n iCONIX 
n FREE CATALOG 
S2.50 SHIP & HANDLE 



10221 Slater 
Fountain Valley 



ICONIK 

ICONIX is a graphics 
and animation editor for 
the APPLE II series of 
computers. ■ It utilizes a 
unique loggleable magntfi ca- 
tion and panning movement 
to edit a hUres image directly 
tram tlie keyboard, and a tas- 
fioe techntque Xo capture and 
compile Icons from a section oi a 
hi-re& scireen. One* you have an 
Leon you can p^ce It anywhere on a 
hi-rea Image., as many Umes as you 
wan) v^ith l^e OVERLAY i^aiun^ nr you 
cnn «Hve II to disk and uk xtne or a 
coTnblnBtlwn oJ st^er bI relotfll^blf machinfl 
COQD motlijlei to mir^tpul«l» 1ii« "Cum Ifom 
yauf own orfHirAm -,. mqiiib, inijnuilfin! > All 
icon* can tn I^RAWN. XDRAWN or r=LOJ>^TED an 



lOUl 



$29.95 
$29.95 
$00.00 
FOREIGN $4.00 CA. 67n 

Suite 103 
CA 92708 



SO WHAT 




10221 Slater Ave. Suite tD3Foufiiain Valley, Ca927na 



Coming soon... 

(to a maga2[ne near you) 
COMPUTIST No. 35: 

.Softkcvs for: Hi-rcs Cnbbage. Olympic Decathlon, Revisiting F-15 Strike Eagle, Mas(?uerade. 'I'he Hobbit, PtKjyaji. The Perfccl Score. 
Alice ill Wotidcrland. The Money Matiagcr, Good Thinking. 

Feature; Putting a New PS on your Lung u age Cued. 

Core: E\ploririt: ProDOS by installing a CPS I'ltiek Driver. 

Rijvkw; The Senior PROM. , . _ . 

APT: .Sword ol ICadash, 



COMPUTIST No. 36: 

Softktvn fiH*: Flight Simulator 11 V1.KI5. Auioducl, Criiicul Reading. Troll's T;ik-. Robot War. General Manager. Plasmwnia, Tduriuin 
SoitwarL'. Kidwrilei vl,0. Color Me. 

Ftaturc!: Screenwriter meets Flashcard. Ihe Bus Monitor. Mousepaini for non-AppleS:: 

Core: a character editor: The Bard's Dressing Room 

APT: Championship Lodi; Runnt-r, 



by bobby 

PHD, phD, Phd, PhD, 
BUT, BTT, MSG, McDLT 



Requirements 

some S$$ 

postage Stamp 

Envelope 

Pen or compatible word processor 

scissors (optioual) 

Now that HARDCORE has changed its name 
lu plain old 'computist', I've been assigned the 
regrettably redundant responsibility of changing 
all the Diskbusters T- shins. Instead, using my 
own imaginaiy initiative, I've come up with a 
reasonable facsimile of an original idea... 

"Why not," I asked myself, "call ull the 
old Diskbusters T-shirt something catchy 
like: Hardcore Classic?" 

"Wow!" 1 answered myself, "Then ive 
could sell people the NEW computist T-shirts 
thiii summer!" 



(I've heard that some people suspect that 
there's a rurnor that such an artifact does not 
yet exist.. .VAPORWEAR...)" 

If you like my idea, then PLEASE order die 
CLASSIC Hardcore Computist DiskBusters T- 
shirt (simply known as CLASSIC T-shirt) 



1 ) Fdl out the order form below using tli<; Pen 
and then insert Uie order form with appropriate 
$$$ or acceptable substimtes into the envelope, 
and then pen-in the address onto the envelope, 
and then attach the stamp and that's it. 
Enjoy! 



1 want the CLASSIC! so nish me . 



below. I have enclosed S9.9i {plus tax and shipping) for eadi shirt. 
ADULT MENS; _Small Medium 



ftotal) Classic DISKBUSTERS T-SHIRTS in Ihe siass indkawd 



J.arge 



Xtra lar^e 



Name 

Address. 
City. . 



JD#_ 



.State. 



-Zip- 



Country _ 
Signature. 



Phone 



Exp. 



XP34 



Send check or money order to; BuIIshirt; PO Box 1 10816-T: Tacoma, WA 98411, 
Washington orders add 7.8% sales tax. Foreign orders add 20% shipping and liandling. 
US funds drawn on US bank. OFFER GOOD WHILE SUPPLIE.S LAST. 



5 FREE DISKS 

With every set of 20 disks you order. You can get sets for as low as 

$lT.OO 

That's a total of 25 dislcs for as little as 

68<t a disk 

These are SS/DD Namebrand, 5V4" floppies, 100% guaranteed, & include: 
reinforced tiubs, write-protect tabs, & Tyvek sleeves. 



Name . 



JD#. 



Address 
City 



Send rne . 



.sets at $17.00 per aet. 



State 



21p 



Country 



Phone 



Exp. 



Signature . 



. CP3d 



MosI orders shipped UPS. Piease use street address. 



Add $3 shipping and handling for the first sat, 
and $1 (or each addittonai set. 
Foreign orders add 20% shipping and handling, 
U.S. tunds drawn on tJ.S. banks only, 
Wttstiington orders add 7.8% sales tax. 
Send your orders to; 

^1I»nKt^y PiifilLsfiin^ 

PO tins 1)0846-7 

Tacoma. WA S«41l 



Description of Available Back Issues 



Sofikeys \ Word Juggler | Tmk'. TonW | 
SunJog v2,0 I G.l. Six &. Lucas film's Eiauloii I 
Summer Gumes II | Thief 1 Iniimu Pttstiil | WorlH's 
(jrealesL Fuoitiall 0;iiiif I Rfiidt-n ' Sofikcys \ Graphic 
AJvenlitrc H[ | Seiisthle Grammitr & Extended 
Rmiketids I Chipwits | Hardball I King'.'i Quest II I The 
World's Greatest Baseball Game | Feaum- I How to be 
the Sound Master I Core | The Mitpptngul Ullimu IV , 



Softicy.i I Revisiting Music Consiruclion 
Set I Cubil , Baud vi lie Sol'tware | I la nicy Software | 
Bridge | Early Games for Young Ciiildreii | Tawala's 
Last Redoubt | Readers' Sofikeys I Print Shop 
Corapaniun I KraL'kma Vol II ! Miiebiiis | Mouse 
Budget, Mousf Wnrcl A. Mciiise Desk | Adventure 
t'tmstiiteiinn Set | Fi^mure \ Using Data Disks With 
Mitro/.ines | Cor^ '< Super JOB vl,5 a Reprint | 

^9 1 S(jfltevs I Trivia Fever | The Original 
Boston Computer Diet | T.ifesaver I Synergistic 
Software I Blading Paddles Zardax | Readers ' 
Sofikayn I Time Zone | Tycoon | Earthly Delights I 
Jingle Disk I Crystal Caverns | K.ara!e Champ | 
Feame I A Little Help with The Bard's Tale | Cvre j 
Black Box | Unrcstrieied Ampersand | — 



So/tfovj I Millionaire 1 SSI's RDOS I 
Fa mavis ion | Spy vs. Spy 1 Dragcmworld I Reaikr<i' 
Softkeys \ thing's Quest | Mastering the SAT | Easy as 
ABC j Space Shuttle I The Factory | Vrsidejt I.IE | 
Sirerlock Hiilme^ 1 Ttie Bards Tale | Feature \ 
Inereasing Your Disk Capacilj ' Corf \ Ultimaker IV, 
an Ultima IV Character Editor | - 



Softksyi ! Threshold | Checkers v2. 1 I 
Micrntjpe | Gen. & Organic Chemistry Series Uptown 
Trivia | Murder by the Doien | Readers ' Sojiktyi \ 
Windham's Classics I Batter Up | Evelyn Wood's 
Dynamic Reader | Jenny of the Prairie | l^eam Aboiii 
Sounds in Reading I Wmter Games 1 Feature \ 
Customizing the Monitor tiy Adding 65C02 
Disassembly | Corf | The Animator | 



Sajikeys | Ultimii iV | Robot Odyssey ! 
KeridcivoiLs | Word Attack &. Classmate | Thtte from 
Miiidscape | Alphabetic lieyboarding | Hacker | Disk 
Director | Lode Runner I MIDL/4 ■' Readers' Sofikeys \ 
Algebra Series I Time is Money | Pitstop II 1 Apvcnture 
to Atlantis i Fcmire \ Capturing the Hidden Archon 
Editor I Core I hmgerpriiii Plus: A Review | Henealli 
Beyond Caslle Wolfensieiii (fart Z) | .,,,„,„.>,,,,„,. 



Sofikeys | Micivzines 1-5 ! Microiines 
7-^ I Microiines (alternate method) | Phi Beta Filer | 
Sword of Kadash 1 Rentiers ' Suflkeys i Aniither Miner 
204Qer I Learning With Fui?.ywomp | Bookends | 
Apple Logo II I Murder on the Zmderneul' ' Ffatttres \ 
Daleks: Exploring Artificial Intelligence | Making .12K 
or I6K Slave Disks | Core \ The Games of l%5: pan 

ni 



Sojikeyi I Cannonbail Blitz | Instani 
Recall I Gessler Spanish Software I More Siickybcars | 
Readers' Sofikeys | Financial Cookbook | Super 
Za.vxon Wizardry | Preschool Fun ! Holy Grail | 
Inca I I2SK Za\)iHn i Fciitiire \ PntEdil | Qire \ Oames. 
of I%5 pani I ..-, - 



St.fftlcey^ I DB' Master 4.2 | Business 
■Wilier , Baiion's Computer SAT [ Take I | Bank Street 
Speller ■ Where In The World Is Carmen Sandicgo | 
Bank Street Writer I2SK | Word Challenge | Readers ' 
Sofikeys I Spy's Demise | Mind Prober I BC's Quest For 
Tires I Earlv Games | Homeword Speller | Feanve \ 
.\dding IF THEl^ RUSF To Applesoft | Core ' DOS To 
PloDOS And Back | 



Sofiktys I Electronic Arts software ! 
Grolier software | Xyphus I F-IS Strike Eagle I Injured 
Engine | Readers' Sofikevs | Mr. Robot .'^nd HisKoboi 
Factory I Applecillm II [ Alphabet Zoo | Fathoms 40 | 
Story Maker I Early Gaiues Matchmaker | Robots Of 
Dawn I Fi'titun' Essential Data Duplicator copy 
parms 1 Core \ Direct Sector Access From DOS | .. 



Sofikeys | Choplitier j Mul'plot i 
Flashcflle | Karate ka | Newsroom | H-7. Draw i 
Headers ' Sofikns I Gaio | Dino Eggs- 1 Pinball 
Conslnidion Set | TAC | The Print Shop; Graphics 
Library | Death In The Caribbean i Features i Using 

A.R.D. To Sofikey Mars Cars I How To Be The 
Writemastcr | Corf | Wheel Of Money 1 



Siifikijx 1 Miner 2049er ' Lode Runtiet 
A2-Plil Pi [ibid I 1 Rmdm' $iif!keys | The Heist | Old 
Ironsides | Gratidma's House In Search of the Most 
Amazing Thing |.Morloc's Tower \ Marauder ' Sargon 
ID I Feanires \ Customized Drive Speed Control j Super 
lOB version 1,5 I Core \ The Macro System I 



Sofikeys \ Sargnn III | Wijardry Prvivinjt 
Grounds of the Mad Overlord and Knight of Diamonds ' 
Read(f ' Sofikeys | The Report Card V 1 . 1 | K id w titer 
fej/H/r I Apple II Boot ROM Disassembly I Core \ The 
Graphic Grabber v3.0 ! Copy 11+ 5.0: A Review The 
Know-Drive; A Hardware Evaluation | An Improved 
BASIC/Binary Combo I „.,„-...„. 

1 S9 Readers ' Sofikeys | Rendezvous With 
Rama PeachireesBackTo Basics Accounting System | 

HSD Siaiisiics Series : Ariihmetickic | Aridimekieks and 
Early Games for Children | Features Double Your 
ROM Space I Towards a Better FS ROM | Hic Niiihlei 
A Utility Program to Exjiiiiine Raw Kiijiiles From Disk | 
Core I The GallK.^ of IW4. in Review -part II | 

1 ^* Sofikeys \ The Prim Shop 1 Crossword 
Magic ' The Standing Stone* | Beer Run | Sky fox | 
Rand Oil) House Disks I Features I A 'Ilitorial For Disk 
Inspection and the Use Of Super lOB | S-C Macro 
Assembler Directives (ir.print) , Cfwe , The Graphic 
Grabber For The Print Shop | The Lone Catalog 
Arranger vI.O Fart 2 | 

1 6 Sofikey I Sensible Speller for ProDOS j 
Sidcivays Reailers ' Sofikeys I Rescue Raiders ; Sheila | 
Basic Building Blocks | Artsci Programs | CrossHre | 
Feature \ Secrel Weapooi: RAMcard I Core I The 
Control lei Wtitei I A Fix for The Beyond Ca.stlc 
Wiilfenstein Softkey | The Lone Catalog Airanger 
Panl I 



1 3 Sofikeys | Uf Pak | Beyond Castle 
Woltenstein '. Transylvania I The Quest 1 Electronic 
Arts I Snooper Troops (Case 2) I DLM -Sottware I 
Learning With beeper | TellStar | Core | CSaver; The 
Advanced Way lo .Store Super IfJB Controllers Adding 
New Commands to DOS .1,3 Fising ProDOS 1.0. 1 
BSAVE Bug I ficiJfM' I Enhancing Your Apple i 
Feature I Locksmith 5,0 and Locksmith Programming 
Language | , ....,-.„...,,..,.,.,..,,„ 

1 1 Sofiki/vs I Se risible S|ielter 1 Exodus: 
L'lllina III I Reader.^' Siifikeys \ SoilPnrn Adventure | 
Tlie F.insiein Compiler v5.."i | Mask of The Sun | 
Featio-es Copy jl Plus (4.4Ci: Update Of An Old 
Friend | Parameter List For Essential Data Duplicator , 
Core I Ultimaker UI i The Mapping of Ultinm HI 1 
Ultitra U,.,The Rest 01 The Htelure | ., ... 

■» Sofik(ys 1 Zaxson | Mask ol the San | Crush I 
Crumble & Chomp | Snake Byte l.IH Master 1 
Moriskatiack ; Features | Makinc Liberated Backups 
That Retain Their Copy Protection S-C Assembler: 
Review 'Disk Directory Designer | Core \ Core filer: 
Part I I Upper &. Lower Case Output for Zork I .... 

^1 Sojikeyi Ultima II | Witness 1 Prisoner 11' Pest 
Patrol I .adventure Tips for Ultima II & III | Copy II 
Plus FARMS Update | Fmturt , Ultima II Character 
Editor I — — 

1 Sofikeys I Data Reprter | Multiplan | Zork I 

Featiovs I PARMS tor Copy U Plus ' No More Bugs | 

A PT ' s for Chopl i fte r & Can II onbnl I R I i I / I 'Cfj/j yrujv/ ' 
Revk'v.i I Rc[.ilav I Ciackshol | Snapshot | Wildcard | 

CORE 3 Games: 

Constnietin^ Your Own loy stick. | Compiling Games | 
GAMF. RFVIF.m: Over JO of the latest and best Pick 
Of The Pack: All-time TOP 20 games Deslrudive 
Forces | EAMON Graphics Magician and 
GraFORTII ' Dragon Dungeon I 

CORE 2 Utilites: 

Dynamic Menu I High Res: Scroll Demo i GOTO 

Label: Replace | Line Find (Jmck (^^i.ipy: Copy I 

CORE 1 ..Graphics: 

Mcttioo' Map 1 Test Graphics: Marquee , Boxes I 
Jagged Scroller | Low Res: Color Character Chan 
High Res, Screen Cruncher | The UFO Factory 
Color I Vector Graphics: Shimmering Shapes i A Shape 
Table Mini-Editor i Block Graphics; Arcade Quality 
Graphics for BASIC Programmers | Animation | .-.. 

Hardcore Computing 3 

HypcrDOS Creator | Menu Hello | Zyphyr Wars 
Vector Graphics i Review ot Bit Copiers , Bool Code 
Tracing | Softkey lOB | Interview willi 'Mike' 
Markkula! 

For speviai savings, order our 

'Core Special' 

and receive all three CORE 

magazines for only $10.00 
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BACK ISSUES 

and 

LIBRARY 
DISKS 

of COMPUTIST ( formerly Hardcore COMPUmTj 

are stiU available, though some issues (marked N AJ are sold out, 
library disks are available for ALL issues of COMPUTIST. 

LIBRARY DISKS 

are perfect companions for 

COMPUTIST 

Documentation for Librarj Disks is in the corresponding issue. 



Send rne the back issues and/or library disks indicated: 








Name 




ID* 




ArtrlMRSs 








Oity . . StatB 7ip 








Onnntry Phnns 








Tin' ^^ 


Em 






SJqnatuie 






nm 



Send check or money order to: COMPUTIST PO Box n0846-T Tacoma, WA 984 1 1 , fHost orciers shipped 
UPS so please use street address. Offer good while supply lasts. In Washington state: add 7.8^ sales tax. 



Back Issue Rates For Foreign Orders 



FOREIGN MAGAZINE ORDERS •' 

Price for each magazine includes shipping. 

1 ' 2 copies 



3 to 4 copies 5 or more copies 



Canada/Mexico .$8.00 each.... $7.00 each $6.00 each. 

Other Foreign $14.25 each... $13.25 each 12.25 each . 



FOREIGN DISK ORDERS 



Disks are Si 1.94 each (includes shipping). Special "Both" disk and magaztne combinations showm 
do NOT apply to Foreign orders, US funds drawn on US banks. All foreign orders sent AIR RATES. 
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Writer's Guide 



COMPIJTIST 

i}> it iiiiiriilil> niugii^liic deilKuied (ii Lite 
serious user ol the Apple (or ciimpatible) 
aimputL-r COMPL!T[ST wclainics articles 
on a. varieiv of subjiiets in all levels ol" 
iL'clinical diffk'uUy bui requires accurate 
Jiiia. technical competence, correct Englisii 
usage. [Mailable stylo, and ful[\ doHiicd 
jargon and bu;!2W()rds. 



MANUSCRIPT 
MECHANICS 



All manuscripts must be typed or printed 
an one side ui' the paix.'r. Text stiuuld be 
double-spaced. 

Printouts should use a mm-compressed 
font with both upper and lowcf case. A letter 

quulily nunje is piejerix^d. with each pa^e 

torn at the perforation onl^. Pages need not 
l>e siaptcU Ujgethei .The cover page of each 
manuscript should contain the tOllowmg 
data: 

TITLE OF WORK 

FULL NAME OF AUTHOR 

ADDRESS 

PHONE NUMBER 

Hach page of the manuscript and program 
li»,tiiig should include the ;iuthor's name, the 
title of the work, and the page number in 
the upper right h;md corner. 

The iirlicic and uiiv iictonipanyiiig 
program SHOULD BE SUTIMETTED AS 
A STANDARD TEXT FILE ON A DOS 
i.i DISK. Label the disk with the title of 
the work and the author's full name and 
address. ON DISK. TKXT MUST BE 
SINGLE-SPACED ONLY. Please idendiy 
your editing program. 

Original titsks are always returned as sixai 
as possible. Other materials will be returned 
only when adequate retuin packaging and 
postage is enclosed. We are not responsible 
lor uiireturned suliinissiuus. We will 
guaniniee the return of original commercial 
disks mailed to ui- for verification of an 
accompanying !;ofikey. 

You will be iiotillcd of the status of your 
submission within 4 to 6 weeks after it is 
received if the article i.'i a soflkey 
accompanied by an orifiinal disk. Please 
submit completed manuscripts directly; do 
not query llrst. Previously published 
matei iai imd simultaneous submissions arc 
not accepted. 



I 



SUB.mCTS 



We prefer mateiial on theb.e topics: 

t) Original program/artiele eumbinations 
1) General articles (Apple computing) 
^) Softkeys 

4) Advanced Playing Techniques (APT's) 

5) Haidwarc modifications 

6) DOS modifications 

7) Product reviews (hardware and software) 

8) Utilities 

9t Bit Copy Parameters 



WRITING 
YOUR ARTICLE 



Ob.se rvc the following pojnts ot style: 

A. Always assume that your reader is a 
novice and explain all buzzwords and 
technical jargon. Pay special attention to 
grammar and pimctiialion; we recjuire 
technical compctenec but also good, 
readable style. 

B. Whenever appropriate, a list of hardware 
and software requirements should be 
included at Ihc beginning of the manuscnpt. 
When published, this list will be offset from 
the main text. 

C. Include the name and address of the 

iminufacturer and lite price when a 
commercial program is mentioned. Thi.s is 
of particular unpoilaiice in PRODUCT 
REVIEWS. 

D. When submilling programs, first 
introduce the purpose of the program and 
leatures of special interest, include 
background information describing its use. 
Tips for advanced uses, program 
modifications, and utilities can also be 
included- Avoid long print .statements and 
use TABS instead of spaces. 

Rciiitfinber: A besjinEier should be able to 

type the program with ease. 

E. A PROORAM is not accepted for 
publication without an accompanying 
article. These articles, as well as articles on 
hardware and DOS modiricatlons MUST 
summarize the action of the main routines 
and include a fully remarked li.<iiing. 



F. GtNhKAL ARTICLES may incltidc 
advanced tips, tutorials, anti explorations of 
a particular aspect of Apple computing, 

G SOFTKEYS of any length are acceptable 
and must contain detailed step-by- step 
procedures. For each .sot'tkcv. first introiliice 
the locking technique used and then give 
precise steps to unlock the copy-prolccled 
program, Number each step whenever 
possible. We accept articles which explain 
locking techniques used m several programs 
published by the same company. 

H. When altering game programs, the 
changes made are sometimes extensive 
enough to warrant the title ot ADVANCED 
PLAYING TECHNIQUE (APT) APTs can 
deal with alterations to a program, deleting 
annoying sounds, acquiring more points in 
play and avoiding hazards. Again, provide 
siep-hy-step instructions to complete each 
APT and explain each step's function. 
\ PT's of 1 00 words or more are preferred. 






AUTHOR'S RIGHTS 



Each article is published under the 
author's byline. As a rule, all rights, as well 
as one-time reprint rights are purchased. 
Purchase of exclusive tights to programs is 
required; however, alternate arrangements 
may be made with individual Liuthots 
depending on the merit of the contribution. 



i 



PAYMENTS 



COMPUTIST pays upon publication. 
Rate of payment depends on the amount of 
editing required and the length of the article. 
Pay mem ranges from S20 to ,^50 per typeset 
page lor an article. We also pay SIO to $20 
for short softkeys and APT's. A fully 
explained ■softkey accompanied by the 
commercial disk for verification may earn 
Up to S.'iO per lype.scl page. 

Please mail your submissions to: 

COMPUTIST 
Editorial Department 

PO Bo\ 110846-T 
Tacoma, W A 98411 
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big deal. 

We realty mean It: Thin Is triily ^ l^i? dpal. Wn want to sell you a bouk or two. Ntfed we fiay mo re? 



K? 



**■,:. 
^-V... 



<«^ 



The Book 

Of Softkeys 

Volume 
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is here. 



At long last, The second volume in our series of compilations is ready. Once 
again, we have combined several issues of (Hardcore) COMPUTIST into one compact 
book. Volume II of the Book Of Softkeys contains articles from issues 6 through 10. 

The Big Deal is, Volume 11 has a lower price than Volume I originally had. Not 
only that, but the price of Volume I has been massively reduced. The two books 
make an economical alternative to those rare (and unavailable) back issues of 
Hardcore COMPUTIST. V^ 



Volume II ($17.95) 



contains softkeys for: Apple CiJcr .Spider | Apple Logo | Arcade 
Machine | The Artist | Bani< Street Writer | Cannoiiball Blitz | Canyon 
Climber I Caverns of Freilag | Crush, Crumble & Chomp | Data Factory 
5.® I Dfi Master | Tht- nic*tinn*ary | llsscntial Data Duplicator 1 & III | 
GotJ Rash ' Kicll Logo | Legacy of Llylgamyr | M.-^sk Of The Sun | Minil 
M;m I Muuskaltack 1 Masic CiuislrLiLiion Set | Oil's Wcl! | Pandora's 
Box I l-^obotron | Siimmy Lighd'ool | SereeEiwriter II v2.2 | Sensible 
Speller 4.0. 4. Be, 4. Ic | the Spy Strikes Back | Time Zone v 1 . 1 | VisibiL- 
Compiiier; 6.Sfl2 | Visidex 1 Visitenn | Za\xon | Ilayden Software | Sierra 
Online Software | PLUS the complete listing of the ultimate craclcing 
program. ..Super lOB 1.5 I and more! 



Volume I <$ 12.95) 



contains softkeys for: Akalabeth | Aui[;K;niiugic | Apple Galuxiaii | Aztec | 
BagofTrick.s | Bill Budge's 'frilogy | Buzzard Bail ! Canncnball Blii/ | 
Casino | Dam Reporter | Deadline I Disk Organizer li | Egbert II 
Communications; Di.sk | Hard Hat Mack | Home Accountant 
Home word | Lancaster | Magic 'Window II | Multi-disk Catalog 
Multiplan | Pest Patrol | Prisoner II | Sammy Lightfooi | Screen Writer 
ir I Sneakers | Spy's Demise | SiarcrotiS j Suspended 1 Ultima II 
"Visifile | "Visiploi | Visitrend i Witness i Wizardry | Zork 1 | Zork II 
Zork III I PLUS how-to articles and program listings of necd-to-have 
programs used to make unprotected backups. 



To Order: Send $17.95 + Shipping and Handling for Volutne II and/or $12.95 + S&H for Volume I. Shipping and handling is $2.00 
per book lor US orders, $5.00 per book Ibr foreign orders, U.S. funds drawn on U.S. banks only. Washington State orders add 7.8% 
sales tax. Send your orders to: Stiff Key Piiblitihing, PO Box 110937-BK, Tacoiiia, WA 98411 



